Commit 9e1fda4ae158 ("ASoC: dapm: Implement mixer input auto-disable") is trying to
free the widget it allocated by snd_soc_dapm_new_control() call in
dapm_kcontrol_data_alloc() by adding kfree(data->widget) to dapm_kcontrol_free().
This is causing a widget double free with auto-disabled DAPM kcontrols in sound card
unregistration because widgets are already freed before dapm_kcontrol_free() is
called.
Reason for that is all widgets are added into dapm->card->widgets list in
snd_soc_dapm_new_control() and freed in dapm_free_widgets() during execution of
snd_soc_dapm_free().
Now snd_soc_dapm_free() calls for different DAPM contexts happens before
snd_card_free() call from where the call chain to dapm_kcontrol_free() begins:
soc_cleanup_card_resources()
soc_remove_dai_links()
soc_remove_link_dais()
snd_soc_dapm_free(&cpu_dai->dapm)
soc_remove_link_components()
soc_remove_platform()
snd_soc_dapm_free(&platform->dapm)
soc_remove_codec()
snd_soc_dapm_free(&codec->dapm)
snd_soc_dapm_free(&card->dapm)
snd_card_free()
snd_card_do_free()
snd_device_free_all()
snd_device_free()
snd_ctl_dev_free()
snd_ctl_remove()
snd_ctl_free_one()
dapm_kcontrol_free()
This wasn't making harm with ordinary DAPM kcontrols since data->widget is NULL for
them.
Signed-off-by: Jarkko Nikula <jarkko.nikula@xxxxxxxxxxxxxxx>
Cc: stable <stable@xxxxxxxxxxxxxxx> # 3.12+
---
sound/soc/soc-dapm.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index c8a780d0d057..7769b0a2bc5a 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -254,7 +254,6 @@ static int dapm_kcontrol_data_alloc(struct snd_soc_dapm_widget *widget,
static void dapm_kcontrol_free(struct snd_kcontrol *kctl)
{
struct dapm_kcontrol_data *data = snd_kcontrol_chip(kctl);
- kfree(data->widget);
kfree(data->wlist);
kfree(data);
}
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html