Skip to content

Commit ce78930

Browse files
brooniebroonie
committed
ASoC: mediatek: fix use-after-free in driver remove
Merge series from Trevor Wu <trevor.wu@mediatek.com>: These patches concern modifications made in mt8186[1]. The clock unregistration mechanism used in mt8188 and mt8195 is similar with mt8186, resulting in the same problem existing within the driver. Therefore, the solution has also been applied to these two platforms. [1] https://lore.kernel.org/all/20230511092437.1.I31cceffc8c45bb1af16eb613e197b3df92cdc19e@changeid/
2 parents 524306c + dc93f0d commit ce78930

File tree

10 files changed

+48
-70
lines changed

10 files changed

+48
-70
lines changed

‎sound/soc/mediatek/mt8188/mt8188-afe-clk.c

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -418,13 +418,6 @@ int mt8188_afe_init_clock(struct mtk_base_afe *afe)
418418
return 0;
419419
}
420420

421-
void mt8188_afe_deinit_clock(void *priv)
422-
{
423-
struct mtk_base_afe *afe = priv;
424-
425-
mt8188_audsys_clk_unregister(afe);
426-
}
427-
428421
int mt8188_afe_enable_clk(struct mtk_base_afe *afe, struct clk *clk)
429422
{
430423
int ret;

‎sound/soc/mediatek/mt8188/mt8188-afe-clk.h

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,6 @@ int mt8188_afe_get_mclk_source_clk_id(int sel);
100100
int mt8188_afe_get_mclk_source_rate(struct mtk_base_afe *afe, int apll);
101101
int mt8188_afe_get_default_mclk_source_by_rate(int rate);
102102
int mt8188_afe_init_clock(struct mtk_base_afe *afe);
103-
void mt8188_afe_deinit_clock(void *priv);
104103
int mt8188_afe_enable_clk(struct mtk_base_afe *afe, struct clk *clk);
105104
void mt8188_afe_disable_clk(struct mtk_base_afe *afe, struct clk *clk);
106105
int mt8188_afe_set_clk_rate(struct mtk_base_afe *afe, struct clk *clk,

‎sound/soc/mediatek/mt8188/mt8188-afe-pcm.c

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3185,10 +3185,6 @@ static int mt8188_afe_pcm_dev_probe(struct platform_device *pdev)
31853185
if (ret)
31863186
return dev_err_probe(dev, ret, "init clock error");
31873187

3188-
ret = devm_add_action_or_reset(dev, mt8188_afe_deinit_clock, (void *)afe);
3189-
if (ret)
3190-
return ret;
3191-
31923188
spin_lock_init(&afe_priv->afe_ctrl_lock);
31933189

31943190
mutex_init(&afe->irq_alloc_lock);

‎sound/soc/mediatek/mt8188/mt8188-audsys-clk.c

Lines changed: 24 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,29 @@ static const struct afe_gate aud_clks[CLK_AUD_NR_CLK] = {
138138
GATE_AUD6(CLK_AUD_GASRC11, "aud_gasrc11", "top_asm_h", 11),
139139
};
140140

141+
static void mt8188_audsys_clk_unregister(void *data)
142+
{
143+
struct mtk_base_afe *afe = data;
144+
struct mt8188_afe_private *afe_priv = afe->platform_priv;
145+
struct clk *clk;
146+
struct clk_lookup *cl;
147+
int i;
148+
149+
if (!afe_priv)
150+
return;
151+
152+
for (i = 0; i < CLK_AUD_NR_CLK; i++) {
153+
cl = afe_priv->lookup[i];
154+
if (!cl)
155+
continue;
156+
157+
clk = cl->clk;
158+
clk_unregister_gate(clk);
159+
160+
clkdev_drop(cl);
161+
}
162+
}
163+
141164
int mt8188_audsys_clk_register(struct mtk_base_afe *afe)
142165
{
143166
struct mt8188_afe_private *afe_priv = afe->platform_priv;
@@ -179,27 +202,5 @@ int mt8188_audsys_clk_register(struct mtk_base_afe *afe)
179202
afe_priv->lookup[i] = cl;
180203
}
181204

182-
return 0;
183-
}
184-
185-
void mt8188_audsys_clk_unregister(struct mtk_base_afe *afe)
186-
{
187-
struct mt8188_afe_private *afe_priv = afe->platform_priv;
188-
struct clk *clk;
189-
struct clk_lookup *cl;
190-
int i;
191-
192-
if (!afe_priv)
193-
return;
194-
195-
for (i = 0; i < CLK_AUD_NR_CLK; i++) {
196-
cl = afe_priv->lookup[i];
197-
if (!cl)
198-
continue;
199-
200-
clk = cl->clk;
201-
clk_unregister_gate(clk);
202-
203-
clkdev_drop(cl);
204-
}
205+
return devm_add_action_or_reset(afe->dev, mt8188_audsys_clk_unregister, afe);
205206
}

‎sound/soc/mediatek/mt8188/mt8188-audsys-clk.h

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,5 @@
1010
#define _MT8188_AUDSYS_CLK_H_
1111

1212
int mt8188_audsys_clk_register(struct mtk_base_afe *afe);
13-
void mt8188_audsys_clk_unregister(struct mtk_base_afe *afe);
1413

1514
#endif

‎sound/soc/mediatek/mt8195/mt8195-afe-clk.c

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -410,11 +410,6 @@ int mt8195_afe_init_clock(struct mtk_base_afe *afe)
410410
return 0;
411411
}
412412

413-
void mt8195_afe_deinit_clock(struct mtk_base_afe *afe)
414-
{
415-
mt8195_audsys_clk_unregister(afe);
416-
}
417-
418413
int mt8195_afe_enable_clk(struct mtk_base_afe *afe, struct clk *clk)
419414
{
420415
int ret;

‎sound/soc/mediatek/mt8195/mt8195-afe-clk.h

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,6 @@ int mt8195_afe_get_mclk_source_clk_id(int sel);
101101
int mt8195_afe_get_mclk_source_rate(struct mtk_base_afe *afe, int apll);
102102
int mt8195_afe_get_default_mclk_source_by_rate(int rate);
103103
int mt8195_afe_init_clock(struct mtk_base_afe *afe);
104-
void mt8195_afe_deinit_clock(struct mtk_base_afe *afe);
105104
int mt8195_afe_enable_clk(struct mtk_base_afe *afe, struct clk *clk);
106105
void mt8195_afe_disable_clk(struct mtk_base_afe *afe, struct clk *clk);
107106
int mt8195_afe_prepare_clk(struct mtk_base_afe *afe, struct clk *clk);

‎sound/soc/mediatek/mt8195/mt8195-afe-pcm.c

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3255,15 +3255,11 @@ static int mt8195_afe_pcm_dev_probe(struct platform_device *pdev)
32553255

32563256
static void mt8195_afe_pcm_dev_remove(struct platform_device *pdev)
32573257
{
3258-
struct mtk_base_afe *afe = platform_get_drvdata(pdev);
3259-
32603258
snd_soc_unregister_component(&pdev->dev);
32613259

32623260
pm_runtime_disable(&pdev->dev);
32633261
if (!pm_runtime_status_suspended(&pdev->dev))
32643262
mt8195_afe_runtime_suspend(&pdev->dev);
3265-
3266-
mt8195_afe_deinit_clock(afe);
32673263
}
32683264

32693265
static const struct of_device_id mt8195_afe_pcm_dt_match[] = {

‎sound/soc/mediatek/mt8195/mt8195-audsys-clk.c

Lines changed: 24 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -148,6 +148,29 @@ static const struct afe_gate aud_clks[CLK_AUD_NR_CLK] = {
148148
GATE_AUD6(CLK_AUD_GASRC19, "aud_gasrc19", "top_asm_h", 19),
149149
};
150150

151+
static void mt8195_audsys_clk_unregister(void *data)
152+
{
153+
struct mtk_base_afe *afe = data;
154+
struct mt8195_afe_private *afe_priv = afe->platform_priv;
155+
struct clk *clk;
156+
struct clk_lookup *cl;
157+
int i;
158+
159+
if (!afe_priv)
160+
return;
161+
162+
for (i = 0; i < CLK_AUD_NR_CLK; i++) {
163+
cl = afe_priv->lookup[i];
164+
if (!cl)
165+
continue;
166+
167+
clk = cl->clk;
168+
clk_unregister_gate(clk);
169+
170+
clkdev_drop(cl);
171+
}
172+
}
173+
151174
int mt8195_audsys_clk_register(struct mtk_base_afe *afe)
152175
{
153176
struct mt8195_afe_private *afe_priv = afe->platform_priv;
@@ -188,27 +211,5 @@ int mt8195_audsys_clk_register(struct mtk_base_afe *afe)
188211
afe_priv->lookup[i] = cl;
189212
}
190213

191-
return 0;
192-
}
193-
194-
void mt8195_audsys_clk_unregister(struct mtk_base_afe *afe)
195-
{
196-
struct mt8195_afe_private *afe_priv = afe->platform_priv;
197-
struct clk *clk;
198-
struct clk_lookup *cl;
199-
int i;
200-
201-
if (!afe_priv)
202-
return;
203-
204-
for (i = 0; i < CLK_AUD_NR_CLK; i++) {
205-
cl = afe_priv->lookup[i];
206-
if (!cl)
207-
continue;
208-
209-
clk = cl->clk;
210-
clk_unregister_gate(clk);
211-
212-
clkdev_drop(cl);
213-
}
214+
return devm_add_action_or_reset(afe->dev, mt8195_audsys_clk_unregister, afe);
214215
}

‎sound/soc/mediatek/mt8195/mt8195-audsys-clk.h

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,5 @@
1010
#define _MT8195_AUDSYS_CLK_H_
1111

1212
int mt8195_audsys_clk_register(struct mtk_base_afe *afe);
13-
void mt8195_audsys_clk_unregister(struct mtk_base_afe *afe);
1413

1514
#endif

0 commit comments

Comments
 (0)