Received: by 2002:a25:ad19:0:0:0:0:0 with SMTP id y25csp8856545ybi; Wed, 10 Jul 2019 00:30:25 -0700 (PDT) X-Google-Smtp-Source: APXvYqySdpm1SdeP7ubnU7edrw3YeIsbiWhVNKaicb52Pq1/Rx24R47I5sJuwZI29OqZkPtgnN1a X-Received: by 2002:a17:902:42a5:: with SMTP id h34mr38373837pld.16.1562743825801; Wed, 10 Jul 2019 00:30:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1562743825; cv=none; d=google.com; s=arc-20160816; b=vE56kmSpXxXLt7wgOBwz+jtuQiDXoUX7xsQKJqAx3adEw2NlM8krJ5jaZtg6+iUxD9 O4JpT818kQC8cdZ370/5h/EVIdSqPuJvW9NlhIxTQNXXTFVVwMyY0LkYZ1jaPn2Zol47 exJsoQxnrQs8Ti4iA2upxYmiJBXIbvDakOqf6fhc88WqKd2lcjkeSIXE6WsQOE/nlhEv EIXQV7JQlntidVfCRbWxxuBGv7H+8axZGezLG8x8wBYueb3CEbpD1MXSaKjKQ2CXD2e9 oHXDyMhwDSYSrQkob9mhNknyS3ZLik2Um6mwd435FdRrLjr7TP6cQ+7WuGaQQjdRTlM5 4IWg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from; bh=rSIPLJqSeQ1t4scwM4z+59sRxs94yf5XABczKICXyls=; b=tw4mgyKEIE5d9+vw90G8NFaaDW3nL28xv8S5iAbpBvcpg1zyUwr5mgpdKVas/Twds/ 8WdV4j4oar37sMhDHuUL4RPy7zfuslBMCYB7qCUGuQ27ZR/faZ8qTcdWt7Cu/6zIblNf 7R10KbEhW/o8RT3ZOQQppfRTF4NBHeThEBY7wWB+DporH+SxwzElhu/8rJjTmshOq7IF FCO3c8tMctv2IyOCFDOcDvVHO58YMvcjcsJyPBwcTq7aHm/bhDvsoxBorBUgFxW13Xkv 7bn08mdQW2P+sWxI9Y6Mk4dEIggefyXY0MLPuoJ1oGCFjHfisZRibFdz1U05kmTvgaxJ OYZg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id o61si1557114plb.0.2019.07.10.00.30.10; Wed, 10 Jul 2019 00:30:25 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727307AbfGJH3Z (ORCPT + 99 others); Wed, 10 Jul 2019 03:29:25 -0400 Received: from mxhk.zte.com.cn ([63.217.80.70]:27358 "EHLO mxhk.zte.com.cn" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727110AbfGJH3Z (ORCPT ); Wed, 10 Jul 2019 03:29:25 -0400 Received: from mse-fl2.zte.com.cn (unknown [10.30.14.239]) by Forcepoint Email with ESMTPS id 13E8D909B48BCA3D07B5; Wed, 10 Jul 2019 15:29:24 +0800 (CST) Received: from notes_smtp.zte.com.cn ([10.30.1.239]) by mse-fl2.zte.com.cn with ESMTP id x6A7RXF3070833; Wed, 10 Jul 2019 15:27:33 +0800 (GMT-8) (envelope-from wen.yang99@zte.com.cn) Received: from fox-host8.localdomain ([10.74.120.8]) by szsmtp06.zte.com.cn (Lotus Domino Release 8.5.3FP6) with ESMTP id 2019071015275325-2237134 ; Wed, 10 Jul 2019 15:27:53 +0800 From: Wen Yang To: lgirdwood@gmail.com Cc: broonie@kernel.org, perex@perex.cz, tiwai@suse.com, kuninori.morimoto.gx@renesas.com, alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org, jonathanh@nvidia.com, xue.zhihong@zte.com.cn, wang.yi59@zte.com.cn, cheng.shengyu@zte.com.cn, Wen Yang Subject: [PATCH 4/4] ASoC: audio-graph-card: fix an use-after-free in graph_get_dai_id() Date: Wed, 10 Jul 2019 15:25:09 +0800 Message-Id: <1562743509-30496-5-git-send-email-wen.yang99@zte.com.cn> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1562743509-30496-1-git-send-email-wen.yang99@zte.com.cn> References: <1562743509-30496-1-git-send-email-wen.yang99@zte.com.cn> X-MIMETrack: Itemize by SMTP Server on SZSMTP06/server/zte_ltd(Release 8.5.3FP6|November 21, 2013) at 2019-07-10 15:27:53, Serialize by Router on notes_smtp/zte_ltd(Release 9.0.1FP7|August 17, 2016) at 2019-07-10 15:27:37, Serialize complete at 2019-07-10 15:27:37 X-MAIL: mse-fl2.zte.com.cn x6A7RXF3070833 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org After calling of_node_put() on the node variable, it is still being used, which may result in use-after-free. Fix this issue by calling of_node_put() after the last usage. Fixes: a0c426fe1433 ("ASoC: simple-card-utils: check "reg" property on asoc_simple_card_get_dai_id()") Signed-off-by: Wen Yang Cc: Liam Girdwood Cc: Mark Brown Cc: Jaroslav Kysela Cc: Takashi Iwai Cc: Kuninori Morimoto Cc: alsa-devel@alsa-project.org Cc: linux-kernel@vger.kernel.org --- sound/soc/generic/audio-graph-card.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sound/soc/generic/audio-graph-card.c b/sound/soc/generic/audio-graph-card.c index 31fc83d..c8abb86 100644 --- a/sound/soc/generic/audio-graph-card.c +++ b/sound/soc/generic/audio-graph-card.c @@ -63,6 +63,7 @@ static int graph_get_dai_id(struct device_node *ep) struct device_node *endpoint; struct of_endpoint info; int i, id; + u32 *reg; int ret; /* use driver specified DAI ID if exist */ @@ -83,8 +84,9 @@ static int graph_get_dai_id(struct device_node *ep) return info.id; node = of_get_parent(ep); + reg = of_get_property(node, "reg", NULL); of_node_put(node); - if (of_get_property(node, "reg", NULL)) + if (reg) return info.port; } node = of_graph_get_port_parent(ep); -- 2.9.5