ASoC: Intel: Skylake: Fix a couple user after free bugs

We need to use the _safe() version of list_for_each_entry() here because
of the kfree(modules).

Fixes: b8c722ddd548 ("ASoC: Intel: Skylake: Add support for deferred DSP module bind")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c
index 600faad19bd4f9e98ef9e13e9c62af08978dbc32..d43d1976dd3bae9b1844aa62a256b416f6a39692 100644 (file)
--- a/sound/soc/intel/skylake/skl-pcm.c
+++ b/sound/soc/intel/skylake/skl-pcm.c
@@ -1323,10 +1323,10 @@ int skl_platform_unregister(struct device *dev)
 {
        struct hdac_ext_bus *ebus = dev_get_drvdata(dev);
        struct skl *skl = ebus_to_skl(ebus);
-       struct skl_module_deferred_bind *modules;
+       struct skl_module_deferred_bind *modules, *tmp;
 
        if (!list_empty(&skl->bind_list)) {
-               list_for_each_entry(modules, &skl->bind_list, node) {
+               list_for_each_entry_safe(modules, tmp, &skl->bind_list, node) {
                        list_del(&modules->node);
                        kfree(modules);
                }

diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
index 7f285176a0744301c2e76af9180df036c7bed101..0e459d3eb17ab561b7803e4e8296f3a270d8ed26 100644 (file)
--- a/sound/soc/intel/skylake/skl-topology.c
+++ b/sound/soc/intel/skylake/skl-topology.c
@@ -1091,7 +1091,7 @@ static int skl_tplg_mixer_dapm_post_pmd_event(struct snd_soc_dapm_widget *w,
        struct skl_module_cfg *src_module = NULL, *dst_module;
        struct skl_sst *ctx = skl->skl_sst;
        struct skl_pipe *s_pipe = mconfig->pipe;
-       struct skl_module_deferred_bind *modules;
+       struct skl_module_deferred_bind *modules, *tmp;
 
        if (s_pipe->state == SKL_PIPE_INVALID)
                return -EINVAL;
@@ -1105,7 +1105,7 @@ static int skl_tplg_mixer_dapm_post_pmd_event(struct snd_soc_dapm_widget *w,
 
                src_module = w_module->w->priv;
 
-               list_for_each_entry(modules, &skl->bind_list, node) {
+               list_for_each_entry_safe(modules, tmp, &skl->bind_list, node) {
                        /*
                         * When the destination module is deleted, Unbind the
                         * modules from deferred bind list.