From decc27b01d584c985c231e73d3b493de6ec07af8 Mon Sep 17 00:00:00 2001 From: Daniel Mack Date: Tue, 7 Oct 2014 13:41:23 +0200 Subject: [PATCH 1/2] ASoC: core: fix use after free in snd_soc_remove_platform() Coverity spotted an use-after-free condition in snd_soc_remove_platform(). Fix this by moving snd_soc_component_cleanup() after the debug print statement which uses the component's string. Signed-off-by: Daniel Mack Signed-off-by: Mark Brown Cc: stable@vger.kernel.org --- sound/soc/soc-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c index ae48f1013e80..d877ec57d761 100644 --- a/sound/soc/soc-core.c +++ b/sound/soc/soc-core.c @@ -4315,10 +4315,10 @@ void snd_soc_remove_platform(struct snd_soc_platform *platform) snd_soc_component_del_unlocked(&platform->component); mutex_unlock(&client_mutex); - snd_soc_component_cleanup(&platform->component); - dev_dbg(platform->dev, "ASoC: Unregistered platform '%s'\n", platform->component.name); + + snd_soc_component_cleanup(&platform->component); } EXPORT_SYMBOL_GPL(snd_soc_remove_platform); From 5e63dfccf34d4dbf21429c4919f33c028ff49991 Mon Sep 17 00:00:00 2001 From: Daniel Mack Date: Tue, 7 Oct 2014 14:33:46 +0200 Subject: [PATCH 2/2] ASoC: soc-pcm: fix sig_bits determination in soc_pcm_apply_msb() In the SNDRV_PCM_STREAM_CAPTURE branch in soc_pcm_apply_msb(), look at sig_bits of the capture stream, not the playback one. Spotted by coverity. Signed-off-by: Daniel Mack Signed-off-by: Mark Brown Cc: stable@vger.kernel.org --- sound/soc/soc-pcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 731fdb5b5f9b..14a3df1ff1ac 100644 --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -352,7 +352,7 @@ static void soc_pcm_apply_msb(struct snd_pcm_substream *substream) } else { for (i = 0; i < rtd->num_codecs; i++) { codec_dai = rtd->codec_dais[i]; - if (codec_dai->driver->playback.sig_bits == 0) { + if (codec_dai->driver->capture.sig_bits == 0) { bits = 0; break; }