diff options
| author | Jaroslav Kysela <perex@perex.cz> | 2024-12-17 11:07:07 +0100 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2024-12-20 09:51:36 +0100 |
| commit | f25a51b47c61540585a9e8a4e16f91677ebcbbc4 (patch) | |
| tree | 18396b17c9e4ce7c3c1b5b450e628600ca5c5752 /sound | |
| parent | ALSA: compress_offload: avoid 64-bit get_user() (diff) | |
| download | linux-f25a51b47c61540585a9e8a4e16f91677ebcbbc4.tar.xz linux-f25a51b47c61540585a9e8a4e16f91677ebcbbc4.zip | |
ALSA: compress_offload: use safe list iteration in snd_compr_task_seq()
The sequence function can call snd_compr_task_free_one(). Use
list_for_each_entry_safe_reverse() to make sure that the used
pointers are safe.
Link: https://lore.kernel.org/linux-sound/f2769cff-6c7a-4092-a2d1-c33a5411a182@stanley.mountain/
Fixes: 04177158cf98 ("ALSA: compress_offload: introduce accel operation mode")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Cc: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20241217100707.732766-1-perex@perex.cz
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/core/compress_offload.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c index 1d6769a66810..bdb6e307e453 100644 --- a/sound/core/compress_offload.c +++ b/sound/core/compress_offload.c @@ -1174,7 +1174,7 @@ typedef void (*snd_compr_seq_func_t)(struct snd_compr_stream *stream, static int snd_compr_task_seq(struct snd_compr_stream *stream, unsigned long arg, snd_compr_seq_func_t fcn) { - struct snd_compr_task_runtime *task; + struct snd_compr_task_runtime *task, *temp; __u64 seqno; int retval; @@ -1185,7 +1185,7 @@ static int snd_compr_task_seq(struct snd_compr_stream *stream, unsigned long arg return -EFAULT; retval = 0; if (seqno == 0) { - list_for_each_entry_reverse(task, &stream->runtime->tasks, list) + list_for_each_entry_safe_reverse(task, temp, &stream->runtime->tasks, list) fcn(stream, task); } else { task = snd_compr_find_task(stream, seqno); |