Commit f25a51b4 authored by Jaroslav Kysela's avatar Jaroslav Kysela Committed by Takashi Iwai
Browse files

ALSA: compress_offload: use safe list iteration in snd_compr_task_seq() 

The sequence function can call snd_compr_task_free_one(). Use
list_for_each_entry_safe_reverse() to make sure that the used
pointers are safe.

Link: https://lore.kernel.org/linux-sound/f2769cff-6c7a-4092-a2d1-c33a5411a182@stanley.mountain/


Fixes: 04177158 ("ALSA: compress_offload: introduce accel operation mode")
Reported-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Cc: Vinod Koul <vkoul@kernel.org>
Signed-off-by: default avatarJaroslav Kysela <perex@perex.cz>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20241217100707.732766-1-perex@perex.cz
parent 6018f2fe

sound/core/compress_offload.c

+2 −2
Original line number Diff line number Diff line
@@ -1174,7 +1174,7 @@ typedef void (*snd_compr_seq_func_t)(struct snd_compr_stream *stream, 
static int snd_compr_task_seq(struct snd_compr_stream *stream, unsigned long arg,

					snd_compr_seq_func_t fcn)

{

	struct snd_compr_task_runtime *task;

	struct snd_compr_task_runtime *task, *temp;

	__u64 seqno;

	int retval;
@@ -1185,7 +1185,7 @@ static int snd_compr_task_seq(struct snd_compr_stream *stream, unsigned long arg 
		return -EFAULT;

	retval = 0;

	if (seqno == 0) {

		list_for_each_entry_reverse(task, &stream->runtime->tasks, list)

		list_for_each_entry_safe_reverse(task, temp, &stream->runtime->tasks, list)

			fcn(stream, task);

	} else {

		task = snd_compr_find_task(stream, seqno);