[PATCH 5.10/5.15/6.1 0/1] soundwire: stream: use consistent pattern for freeing buffers
Svacer reports NULL-pointer dereference and double free issues in do_bank_switch() in case sdw_ml_sync_bank_switch() returns an error not on the first iteration of the list_for_each_entry() loop. These problems are present in 5.10, 5.15 and 6.1 stable releases. These problems have been fixed by the following upstream patch that can be cleanly applied to 5.10, 5.15 and 6.1 branches.
From: Pierre-Louis Bossart pierre-louis.bossart@linux.intel.com
commit 5ec0c8721c06fc55d8a0bb32c403228358987eb6 upstream
The code should free the message buffer used for data, the message structure used for control and assign the latter to NULL. The last part is missing for multi-link cases, and the order is inconsistent for single-link cases.
Link: https://github.com/thesofproject/linux/issues/4056 Signed-off-by: Pierre-Louis Bossart pierre-louis.bossart@linux.intel.com Reviewed-by: Ranjani Sridharan ranjani.sridharan@linux.intel.com Signed-off-by: Bard Liao yung-chuan.liao@linux.intel.com Link: https://lore.kernel.org/r/20230119073211.85979-2-yung-chuan.liao@linux.intel... Signed-off-by: Vinod Koul vkoul@kernel.org Signed-off-by: Daniil Dulov d.dulov@aladdin.ru --- drivers/soundwire/stream.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c index a377c3d02c55..ecde6fcb8be0 100644 --- a/drivers/soundwire/stream.c +++ b/drivers/soundwire/stream.c @@ -703,8 +703,8 @@ static int sdw_bank_switch(struct sdw_bus *bus, int m_rt_count) }
if (!multi_link) { - kfree(wr_msg); kfree(wbuf); + kfree(wr_msg); bus->defer_msg.msg = NULL; bus->params.curr_bank = !bus->params.curr_bank; bus->params.next_bank = !bus->params.next_bank; @@ -750,6 +750,7 @@ static int sdw_ml_sync_bank_switch(struct sdw_bus *bus, bool multi_link) if (bus->defer_msg.msg) { kfree(bus->defer_msg.msg->buf); kfree(bus->defer_msg.msg); + bus->defer_msg.msg = NULL; }
return 0; @@ -847,6 +848,7 @@ static int do_bank_switch(struct sdw_stream_runtime *stream) if (bus->defer_msg.msg) { kfree(bus->defer_msg.msg->buf); kfree(bus->defer_msg.msg); + bus->defer_msg.msg = NULL; } }
participants (1)
-
Daniil Dulov