Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

ALSA: compress_offload: use safe list iteration in snd_compr_task_seq()

The sequence function can call snd_compr_task_free_one(). Use
list_for_each_entry_safe_reverse() to make sure that the used
pointers are safe.

Link: https://lore.kernel.org/linux-sound/f2769cff-6c7a-4092-a2d1-c33a5411a182@stanley.mountain/
Fixes: 04177158cf98 ("ALSA: compress_offload: introduce accel operation mode")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Cc: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20241217100707.732766-1-perex@perex.cz

authored by

Jaroslav Kysela and committed by
Takashi Iwai
f25a51b4 6018f2fe

+2 -2
+2 -2
sound/core/compress_offload.c
··· 1174 1174 static int snd_compr_task_seq(struct snd_compr_stream *stream, unsigned long arg, 1175 1175 snd_compr_seq_func_t fcn) 1176 1176 { 1177 - struct snd_compr_task_runtime *task; 1177 + struct snd_compr_task_runtime *task, *temp; 1178 1178 __u64 seqno; 1179 1179 int retval; 1180 1180 ··· 1185 1185 return -EFAULT; 1186 1186 retval = 0; 1187 1187 if (seqno == 0) { 1188 - list_for_each_entry_reverse(task, &stream->runtime->tasks, list) 1188 + list_for_each_entry_safe_reverse(task, temp, &stream->runtime->tasks, list) 1189 1189 fcn(stream, task); 1190 1190 } else { 1191 1191 task = snd_compr_find_task(stream, seqno);