ASoC: dapm: Move dai_link widgets to runtime to fix use after free
authorCharles Keepax <ckeepax@opensource.cirrus.com>
Tue, 26 May 2020 16:19:30 +0000 (17:19 +0100)
committerMark Brown <broonie@kernel.org>
Wed, 27 May 2020 12:24:13 +0000 (13:24 +0100)
commitf4aa5e214eeaf7f1c7f157526a5aa29784cb6a1f
treef2a3eaf814b830a9eb1da54143051b9173984076
parent53a58bf96bcdd47c670a957920f3a1bcf7215b39
ASoC: dapm: Move dai_link widgets to runtime to fix use after free

The newly added CODEC to CODEC DAI link widget pointers in
snd_soc_dai_link are better placed in snd_soc_pcm_runtime.
snd_soc_dai_link is really intended for static configuration of
the DAI, and the runtime for dynamic data.  The snd_soc_dai_link
structures are not destroyed if the card is unbound. The widgets
are cleared up on unbind, however if the card is rebound as the
snd_soc_dai_link structures are reused these pointers will be left at
their old values, causing access to freed memory.

Fixes: 595571cca4de ("ASoC: dapm: Fix regression introducing multiple copies of DAI widgets")
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20200526161930.30759-1-ckeepax@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
include/sound/soc.h
sound/soc/soc-dapm.c