staging: greybus: audio: fix loop cursor use after iteration
authorJared Kangas <kangas.jd@gmail.com>
Sun, 5 Jun 2022 23:18:06 +0000 (16:18 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 6 Jun 2022 06:08:03 +0000 (08:08 +0200)
commit80c968a04a381dc0e690960c60ffd6b6aee7e157
treec0efeb5922c96df54f8c827f930abbd916c815c3
parent79053469559d0cf0d4106fb8b3784b8cd9fa4f61
staging: greybus: audio: fix loop cursor use after iteration

gbaudio_dapm_free_controls() iterates over widgets using
list_for_each_entry_safe(), which leaves the loop cursor pointing to a
meaningless structure if it completes a traversal of the list. The
cursor was set to NULL at the end of the loop body, but would be
overwritten by the final loop cursor update.

Because of this behavior, the widget could be non-null after the loop
even if the widget wasn't found, and the cleanup logic would treat the
pointer as a valid widget to free.

To fix this, introduce a temporary variable to act as the loop cursor
and copy it to a variable that can be accessed after the loop finishes.

This was detected with the help of Coccinelle.

Signed-off-by: Jared Kangas <kangas.jd@gmail.com>
Link: https://lore.kernel.org/r/20220605231806.720085-1-kangas.jd@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/greybus/audio_helper.c