linux/drivers/soundwire
Tom Rix 3fbbf2148a soundwire: fix double free of dangling pointer
clang static analysis flags this problem

stream.c:844:9: warning: Use of memory after
  it is freed
        kfree(bus->defer_msg.msg->buf);
              ^~~~~~~~~~~~~~~~~~~~~~~

This happens in an error handler cleaning up memory
allocated for elements in a list.

	list_for_each_entry(m_rt, &stream->master_list, stream_node) {
		bus = m_rt->bus;

		kfree(bus->defer_msg.msg->buf);
		kfree(bus->defer_msg.msg);
	}

And is triggered when the call to sdw_bank_switch() fails.
There are a two problems.

First, when sdw_bank_switch() fails, though it frees memory it
does not clear bus's reference 'defer_msg.msg' to that memory.

The second problem is the freeing msg->buf. In some cases
msg will be NULL so this will dereference a null pointer.
Need to check before freeing.

Fixes: 99b8a5d608 ("soundwire: Add bank switch routine")
Signed-off-by: Tom Rix <trix@redhat.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20200902202650.14189-1-trix@redhat.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
2020-09-03 14:10:19 +05:30
..
bus_type.c soundwire: extend SDW_SLAVE_ENTRY 2020-06-30 21:26:17 +05:30
bus.c soundwire: bus: fix typo in comment on INTSTAT registers 2020-08-19 14:39:05 +05:30
bus.h soundwire: add Slave sysfs support 2020-05-20 17:22:41 +05:30
cadence_master.c soundwire: intel/cadence: merge Soundwire interrupt handlers/threads 2020-07-21 16:05:41 +05:30
cadence_master.h soundwire: intel/cadence: merge Soundwire interrupt handlers/threads 2020-07-21 16:05:41 +05:30
debugfs.c soundwire: debugfs: clarify SDPX license with GPL-2.0-only 2020-05-05 08:51:44 +05:30
intel_init.c Soundwire: intel_init: save Slave(s) _ADR info in sdw_intel_ctx 2020-07-21 16:05:41 +05:30
intel.c soundwire updates for 5.9-rc1 2020-07-23 09:12:15 +02:00
intel.h soundwire: intel: add wake interrupt support 2020-07-21 16:05:41 +05:30
Kconfig soundwire: qcom: add support for SoundWire controller 2020-01-14 11:57:47 +05:30
Makefile soundwire: Replace 'objs' by 'y' 2020-06-22 17:06:08 +05:30
master.c soundwire: master: add sysfs support 2020-05-20 17:22:36 +05:30
mipi_disco.c soundwire: disco: s/ch/channels/ 2020-05-20 17:22:30 +05:30
qcom.c soundwire: qcom: Constify static structs 2020-06-22 17:28:10 +05:30
slave.c soundwire: bus_type: introduce sdw_slave_type and sdw_master_type 2020-05-19 12:44:34 +05:30
stream.c soundwire: fix double free of dangling pointer 2020-09-03 14:10:19 +05:30
sysfs_local.h soundwire: add Slave sysfs support 2020-05-20 17:22:41 +05:30
sysfs_slave_dpn.c soundwire: fix spelling mistake 2020-05-20 17:29:37 +05:30
sysfs_slave.c soundwire: fix trailing line in sysfs_slave.c 2020-05-20 17:27:45 +05:30