From 0ce73465f1a64414e21a6d4aee0619d9ceec47a7 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 17 Jan 2021 15:14:12 +0100 Subject: [PATCH] 4.4-stable patches added patches: asoc-dapm-remove-widget-from-dirty-list-on-free.patch --- ...emove-widget-from-dirty-list-on-free.patch | 45 +++++++++++++++++++ queue-4.4/series | 1 + 2 files changed, 46 insertions(+) create mode 100644 queue-4.4/asoc-dapm-remove-widget-from-dirty-list-on-free.patch create mode 100644 queue-4.4/series diff --git a/queue-4.4/asoc-dapm-remove-widget-from-dirty-list-on-free.patch b/queue-4.4/asoc-dapm-remove-widget-from-dirty-list-on-free.patch new file mode 100644 index 00000000000..aef1a8f53df --- /dev/null +++ b/queue-4.4/asoc-dapm-remove-widget-from-dirty-list-on-free.patch @@ -0,0 +1,45 @@ +From 5c6679b5cb120f07652418524ab186ac47680b49 Mon Sep 17 00:00:00 2001 +From: Thomas Hebb +Date: Sat, 12 Dec 2020 17:20:12 -0800 +Subject: ASoC: dapm: remove widget from dirty list on free + +From: Thomas Hebb + +commit 5c6679b5cb120f07652418524ab186ac47680b49 upstream. + +A widget's "dirty" list_head, much like its "list" list_head, eventually +chains back to a list_head on the snd_soc_card itself. This means that +the list can stick around even after the widget (or all widgets) have +been freed. Currently, however, widgets that are in the dirty list when +freed remain there, corrupting the entire list and leading to memory +errors and undefined behavior when the list is next accessed or +modified. + +I encountered this issue when a component failed to probe relatively +late in snd_soc_bind_card(), causing it to bail out and call +soc_cleanup_card_resources(), which eventually called +snd_soc_dapm_free() with widgets that were still dirty from when they'd +been added. + +Fixes: db432b414e20 ("ASoC: Do DAPM power checks only for widgets changed since last run") +Cc: stable@vger.kernel.org +Signed-off-by: Thomas Hebb +Reviewed-by: Charles Keepax +Link: https://lore.kernel.org/r/f8b5f031d50122bf1a9bfc9cae046badf4a7a31a.1607822410.git.tommyhebb@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/soc-dapm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -2316,6 +2316,7 @@ void snd_soc_dapm_free_widget(struct snd + enum snd_soc_dapm_direction dir; + + list_del(&w->list); ++ list_del(&w->dirty); + /* + * remove source and sink paths associated to this widget. + * While removing the path, remove reference to it from both diff --git a/queue-4.4/series b/queue-4.4/series new file mode 100644 index 00000000000..f309d636bdb --- /dev/null +++ b/queue-4.4/series @@ -0,0 +1 @@ +asoc-dapm-remove-widget-from-dirty-list-on-free.patch -- 2.47.3