tree f3199e8790bb0e114cd2863b50e783691767270e
parent 40e2c465894e5b79b49f55d9574dbcda4ac0f08f
parent 6ae4902f2f3400503f9b78e87e8371e4ffde1e0c
author Mark Brown <broonie@kernel.org> 1592230715 +0100
committer Mark Brown <broonie@kernel.org> 1592230715 +0100
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCgAxFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAl7ngzsTHGJyb29uaWVA
 a2VybmVsLm9yZwAKCRAk1otyXVSH0G+0B/4vLVXS4GrMwhcQ86cZkCP6heqAtiAd
 8MbWkAbqjhWLm+yCtnTkMchyagpgC4KUsqS/oyH15ICTSMZmZHDVy88fdEvIAdgP
 ML5DKjy7h6YI3IqzLiFUZ9pgU50ipj0J//50HY/9fOfv97ShsGkMQs8pp4l6403C
 nSSw5S+mynp4uKdn7e6vEaLhm/aNYVoDEdg2qUyHQuHvM0CiUwXflYJLvj2Lmymh
 vZH/Z8/IhYUc9wxETpDpFDdlCphc3RunN9tVV+TpWDMlvHn2MA54F48q7dQ9Mh+N
 zYtsee3BGPmz3dl6k2u/vkbz4jBO5RXayE8mGcnW3LiP/UEjpkj43usb
 =0DOa
 -----END PGP SIGNATURE-----

Merge series "ASoC: topology: fix use-after-free when removing components" from Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>:

This patchset fixes a memory allocation issue and removes a 100%
reproducible use-after-free report thrown by KASAN in automated module
removal tests across multiple platforms.

All the credit goes to Bard Liao for root-causing the issue. DAIs may
be registered at the same time as a component, or when the topology is
loaded. This two-step registration causes the memory for
topology-based DAIs to allocated last, and conversely to be released
first by devres, before the component is released and the DAIs removed
from the component DAI list with snd_soc_unregister_dais().

When we remove a component, by the time we walk through its dai list
to unregister all dais, the dais allocated by the topology have been
freed already by devres and the list is corrupted with pointers that
are no longer valid.

The suggestion is to add an explicit devm_ based registration for
topology-based dais, so that each dai is cleanly removed from the
component dai list in the release operation before devres releases the
allocated memory.

Pierre-Louis Bossart (2):
  ASoC: soc-devres: add devm_snd_soc_register_dai()
  ASoC: soc-topology: use devm_snd_soc_register_dai()

 include/sound/soc.h      |  4 ++++
 sound/soc/soc-devres.c   | 37 +++++++++++++++++++++++++++++++++++++
 sound/soc/soc-topology.c |  3 +--
 3 files changed, 42 insertions(+), 2 deletions(-)

--
2.20.1