ASoC: Intel: Cancel hsw_notification_work before freeing the stream
Subsystems (3)
PATCH 1/1 ASoC: Intel: Cancel hsw_notification_work before freeing the stream
I suppose there is a possibility that hsw_notification_work() may run after sst_hsw_stream_free() which can lead to a kernel crash since struct sst_hsw_stream is freed at that point and
stream = container_of(work, struct sst_hsw_stream, notify_work) is not valid when hsw_notification_work() is run.
---
Untested, I don't have at the moment Haswell to test this and Liam hasn't seen this patch yet so ack/tested-by from him might be good to have :-)
--- sound/soc/intel/sst-haswell-ipc.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/intel/sst-haswell-ipc.c +1 -0
@@ -1207,6 +1207,7 @@ int sst_hsw_stream_free(struct sst_hsw *hsw, struct sst_hsw_stream *stream)trace_hsw_stream_free_req (stream, &stream->free_req); out: +cancel_work_sync (&stream->notify_work);spin_lock_irqsave (&sst->spinlock, flags);list_del (&stream->node);kfree (stream);
Signature · 1 line
1.9.2
Quoted 5 lines · Jarkko Nikula
I suppose there is a possibility that
hsw_notification_work()may run aftersst_hsw_stream_free()which can lead to a kernel crash since structsst_hsw_streamis freed at that point and
stream =container_of(work, struct sst_hsw_stream, notify_work)is not valid whenhsw_notification_work()is run.
Applied, thanks.