* [PATCH] soc: soc-dapm: fix two incorrect uses of list iterator
@ 2022-03-27 8:21 Xiaomeng Tong
2022-03-28 16:31 ` Mark Brown
0 siblings, 1 reply; 3+ messages in thread
From: Xiaomeng Tong @ 2022-03-27 8:21 UTC (permalink / raw)
To: lgirdwood, broonie, perex, tiwai
Cc: alsa-devel, linux-kernel, Xiaomeng Tong, stable
These two bug are here:
list_for_each_entry_safe_continue(w, n, list,
power_list);
list_for_each_entry_safe_continue(w, n, list,
power_list);
After the list_for_each_entry_safe_continue() exits, the list iterator
will always be a bogus pointer which point to an invalid struct objdect
containing HEAD member. The funciton poniter 'w->event' will be a
invalid value which can lead to a control-flow hijack if the 'w' can be
controlled.
The original intention was to break the outer list_for_each_entry_safe()
loop if w->event is NULL, but forgot to *break* switch statement first.
So just add a break to fix the bug.
Cc: stable@vger.kernel.org
Fixes: 163cac061c973 ("ASoC: Factor out DAPM sequence execution")
Signed-off-by: Xiaomeng Tong <xiam0nd.tong@gmail.com>
---
sound/soc/soc-dapm.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index b06c5682445c..2a5a64d21856 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -1686,9 +1686,11 @@ static void dapm_seq_run(struct snd_soc_card *card,
switch (w->id) {
case snd_soc_dapm_pre:
- if (!w->event)
+ if (!w->event) {
list_for_each_entry_safe_continue(w, n, list,
power_list);
+ break;
+ }
if (event == SND_SOC_DAPM_STREAM_START)
ret = w->event(w,
@@ -1699,9 +1701,11 @@ static void dapm_seq_run(struct snd_soc_card *card,
break;
case snd_soc_dapm_post:
- if (!w->event)
+ if (!w->event) {
list_for_each_entry_safe_continue(w, n, list,
power_list);
+ break;
+ }
if (event == SND_SOC_DAPM_STREAM_START)
ret = w->event(w,
--
2.17.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] soc: soc-dapm: fix two incorrect uses of list iterator
2022-03-27 8:21 [PATCH] soc: soc-dapm: fix two incorrect uses of list iterator Xiaomeng Tong
@ 2022-03-28 16:31 ` Mark Brown
2022-03-29 1:28 ` Xiaomeng Tong
0 siblings, 1 reply; 3+ messages in thread
From: Mark Brown @ 2022-03-28 16:31 UTC (permalink / raw)
To: Xiaomeng Tong; +Cc: lgirdwood, perex, tiwai, alsa-devel, linux-kernel, stable
[-- Attachment #1: Type: text/plain, Size: 651 bytes --]
On Sun, Mar 27, 2022 at 04:21:38PM +0800, Xiaomeng Tong wrote:
> case snd_soc_dapm_pre:
> - if (!w->event)
> + if (!w->event) {
> list_for_each_entry_safe_continue(w, n, list,
> power_list);
> + break;
> + }
This doesn't make much sense. The intent here seems to clearly be to
continue; the loop but this doesn't do that - instead it appears that
continue doesn't actually do the equivalent of a continue but rather
skips over an entry. This should instead be replaced with a plain
continue statement.
THe naming of _continue() needs fixing I think - it's just asking to be
a bug. Fortunately there's very few users.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] soc: soc-dapm: fix two incorrect uses of list iterator
2022-03-28 16:31 ` Mark Brown
@ 2022-03-29 1:28 ` Xiaomeng Tong
0 siblings, 0 replies; 3+ messages in thread
From: Xiaomeng Tong @ 2022-03-29 1:28 UTC (permalink / raw)
To: broonie
Cc: alsa-devel, lgirdwood, linux-kernel, perex, stable, tiwai, xiam0nd.tong
On Mon, 28 Mar 2022 17:31:51 +0100, Mark Brown wrote:
> On Sun, Mar 27, 2022 at 04:21:38PM +0800, Xiaomeng Tong wrote:
>
> > case snd_soc_dapm_pre:
> > - if (!w->event)
> > + if (!w->event) {
> > list_for_each_entry_safe_continue(w, n, list,
> > power_list);
> > + break;
> > + }
>
> This doesn't make much sense. The intent here seems to clearly be to
> continue; the loop but this doesn't do that - instead it appears that
> continue doesn't actually do the equivalent of a continue but rather
> skips over an entry. This should instead be replaced with a plain
> continue statement.
>
Yes, you are right. Sorry for a slip of the pen in commit message:
should be "to *continue* the outer list_for_each_entry_safe() loop"
not "to break ...".
I have resend a PATCH v2 for the fix as you suggested, and cc you.
Thank you.
> THe naming of _continue() needs fixing I think - it's just asking to be
> a bug. Fortunately there's very few users.
--
Xiaomeng Tong
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-03-29 1:29 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-03-27 8:21 [PATCH] soc: soc-dapm: fix two incorrect uses of list iterator Xiaomeng Tong
2022-03-28 16:31 ` Mark Brown
2022-03-29 1:28 ` Xiaomeng Tong
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).