renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2025-01-07 13:13:57 +08:00
Code

ALSA: core: Fix the debugfs removal at snd_card_free()

Browse Source 
The commit 2d670ea2bd ("ALSA: jack: implement software jack
injection via debugfs") introduced a debugfs root for each sound card
object.  The debugfs entry gets removed at the card removal, too, but
it turned out that debugfs_remove() is called at a wrong place; it's
after the card object gets freed, hence it leads to use-after-free.

Fix it by moving the debugfs_remove() at the right place, the
destructor of the card device.

Fixes: 2d670ea2bd ("ALSA: jack: implement software jack injection via debugfs")
Reported-and-tested-by: Chris Wilson <chris@chris-wilson.co.uk>
Link: https://lore.kernel.org/r/161228343605.1150.8862281636043446562@build.alporthouse.com
Link: https://lore.kernel.org/r/20210202225629.1965-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Takashi Iwai 2021-02-02 23:56:29 +01:00
parent 016f94feb5
commit 3c4ab49ec5
1 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sound/core/init.c
View File

@ -487,6 +487,10 @@ static int snd_card_do_free(struct snd_card *card)
dev_warn(card->dev, "unable to free card info\n"); dev_warn(card->dev, "unable to free card info\n");
/* Not fatal error */ /* Not fatal error */
} }
#ifdef CONFIG_SND_DEBUG
debugfs_remove(card->debugfs_root);
card->debugfs_root = NULL;
#endif
if (card->release_completion) if (card->release_completion)
complete(card->release_completion); complete(card->release_completion);
kfree(card); kfree(card);
@ -537,11 +541,6 @@ int snd_card_free(struct snd_card *card)
/* wait, until all devices are ready for the free operation */ /* wait, until all devices are ready for the free operation */
wait_for_completion(&released); wait_for_completion(&released);
#ifdef CONFIG_SND_DEBUG
debugfs_remove(card->debugfs_root);
card->debugfs_root = NULL;
#endif
return 0; return 0;
} }
EXPORT_SYMBOL(snd_card_free); EXPORT_SYMBOL(snd_card_free);