ALSA: compress_offload: use safe list iteration in snd_compr_task_seq()

The sequence function can call snd_compr_task_free_one(). Use
list_for_each_entry_safe_reverse() to make sure that the used
pointers are safe.

Link: https://lore.kernel.org/linux-sound/f2769cff-6c7a-4092-a2d1-c33a5411a182@stanley.mountain/
Fixes: 04177158cf98 ("ALSA: compress_offload: introduce accel operation mode")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Cc: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20241217100707.732766-1-perex@perex.cz

diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index 1d6769a66810e6b2082a8cbf899e5d3504fe0103..bdb6e307e453818ed3abdd36860c42f42a87ec17 100644 (file)
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -1174,7 +1174,7 @@ typedef void (*snd_compr_seq_func_t)(struct snd_compr_stream *stream,
 static int snd_compr_task_seq(struct snd_compr_stream *stream, unsigned long arg,
                                        snd_compr_seq_func_t fcn)
 {
-       struct snd_compr_task_runtime *task;
+       struct snd_compr_task_runtime *task, *temp;
        __u64 seqno;
        int retval;
 
@@ -1185,7 +1185,7 @@ static int snd_compr_task_seq(struct snd_compr_stream *stream, unsigned long arg
                return -EFAULT;
        retval = 0;
        if (seqno == 0) {
-               list_for_each_entry_reverse(task, &stream->runtime->tasks, list)
+               list_for_each_entry_safe_reverse(task, temp, &stream->runtime->tasks, list)
                        fcn(stream, task);
        } else {
                task = snd_compr_find_task(stream, seqno);