From 7c221572fade20acc3859640d22cc947d826da5a Mon Sep 17 00:00:00 2001 From: Wu Zhigang Date: Tue, 4 Sep 2018 21:32:49 +0800 Subject: [PATCH 1/2] ASoC:core:bug fix: oops caused by pointer dereference. oops case: the snd_card{} would be freed ahead of dynamic kcontrol remove process, in this process, the snd_card{} will be used, then the oops will be hit. the solution: the operation of removing the dynamic kcontrol should be ahead of snd_card{} free. Signed-off-by: Wu Zhigang --- sound/soc/soc-core.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c index 71fdac067a47bd..49e82131141f0a 100644 --- a/sound/soc/soc-core.c +++ b/sound/soc/soc-core.c @@ -2168,11 +2168,21 @@ static int soc_probe(struct platform_device *pdev) static int soc_cleanup_card_resources(struct snd_soc_card *card) { struct snd_soc_pcm_runtime *rtd; + struct snd_soc_component *component; + int ret; /* make sure any delayed work runs */ list_for_each_entry(rtd, &card->rtd_list, list) flush_delayed_work(&rtd->delayed_work); + /* remove dynamic controls for all component driver */ + list_for_each_entry(component, &card->component_dev_list, card_list) { + ret = snd_soc_tplg_component_remove(component, SND_SOC_TPLG_INDEX_ALL); + if (ret < 0) + dev_err(component->dev, + "error: component free failed %d\n", ret); + } + /* free the ALSA card at first; this syncs with pending operations */ snd_card_free(card->snd_card); From 27f5f6da6c66f40228167154c4c6e6cd74dc1e5a Mon Sep 17 00:00:00 2001 From: Wu Zhigang Date: Mon, 10 Sep 2018 17:26:49 +0800 Subject: [PATCH 2/2] ASoC:topology:delete dynamic object during widget remove remove the dynamic object during the topology free stage. to avoid multi remove operation. Signed-off-by: Wu Zhigang --- sound/soc/soc-topology.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c index 05d177d689e264..00ab616f1bfc67 100644 --- a/sound/soc/soc-topology.c +++ b/sound/soc/soc-topology.c @@ -496,6 +496,7 @@ static void remove_widget(struct snd_soc_component *comp, } free_news: + list_del(&dobj->list); kfree(w->kcontrol_news); /* widget w is freed by soc-dapm.c */