linux/sound/soc/mediatek
Douglas Anderson a93d2afd3f
ASoC: mediatek: mt8186: Fix use-after-free in driver remove path
When devm runs function in the "remove" path for a device it runs them
in the reverse order. That means that if you have parts of your driver
that aren't using devm or are using "roll your own" devm w/
devm_add_action_or_reset() you need to keep that in mind.

The mt8186 audio driver didn't quite get this right. Specifically, in
mt8186_init_clock() it called mt8186_audsys_clk_register() and then
went on to call a bunch of other devm function. The caller of
mt8186_init_clock() used devm_add_action_or_reset() to call
mt8186_deinit_clock() but, because of the intervening devm functions,
the order was wrong.

Specifically at probe time, the order was:
1. mt8186_audsys_clk_register()
2. afe_priv->clk = devm_kcalloc(...)
3. afe_priv->clk[i] = devm_clk_get(...)

At remove time, the order (which should have been 3, 2, 1) was:
1. mt8186_audsys_clk_unregister()
3. Free all of afe_priv->clk[i]
2. Free afe_priv->clk

The above seemed to be causing a use-after-free. Luckily, it's easy to
fix this by simply using devm more correctly. Let's move the
devm_add_action_or_reset() to the right place. In addition to fixing
the use-after-free, code inspection shows that this fixes a leak
(missing call to mt8186_audsys_clk_unregister()) that would have
happened if any of the syscon_regmap_lookup_by_phandle() calls in
mt8186_init_clock() had failed.

Fixes: 55b423d562 ("ASoC: mediatek: mt8186: support audio clock control in platform driver")
Signed-off-by: Douglas Anderson <dianders@chromium.org
Link: https://lore.kernel.org/r/20230511092437.1.I31cceffc8c45bb1af16eb613e197b3df92cdc19e@changeid
Signed-off-by: Mark Brown <broonie@kernel.org
2023-05-15 10:21:13 +09:00
..
common ASoC: mediatek: common: Fix refcount leak in parse_dai_link_info 2023-04-11 12:40:07 +01:00
mt2701 ASoC: mediatek: mt2701-afe-pcm: Convert to platform remove callback returning void 2023-03-20 13:08:36 +00:00
mt6797 ASoC: mediatek: mt6797-afe-pcm: Convert to platform remove callback returning void 2023-03-20 13:08:37 +00:00
mt8173 ASoC: mediatek: mt8173-afe-pcm: Convert to platform remove callback returning void 2023-03-20 13:08:38 +00:00
mt8183 ASoC: mediatek: mt8183-afe-pcm: Convert to platform remove callback returning void 2023-03-20 13:08:39 +00:00
mt8186 ASoC: mediatek: mt8186: Fix use-after-free in driver remove path 2023-05-15 10:21:13 +09:00
mt8188 ASoC: mediatek: mt8188-afe-pcm: Convert to platform remove callback returning void 2023-03-20 13:08:40 +00:00
mt8192 ASoC: mediatek: mt8192-afe-pcm: Convert to platform remove callback returning void 2023-03-20 13:08:41 +00:00
mt8195 ASoC: mediatek: mt8195-afe-pcm: Convert to platform remove callback returning void 2023-03-20 13:08:42 +00:00
Kconfig ASoC: mediatek: Add support for MT8188 SoC 2023-01-19 15:31:47 +00:00
Makefile ASoC: mediatek: mt8188: add platform driver 2023-01-16 11:16:26 +00:00