ASoC: dapm: delete dapm_kcontrol_data paths list before freeing it

dapm_kcontrol_data is freed as part of dapm_kcontrol_free(), leaving the paths pointer dangling in the list. This leads to system crash when we try to unload and reload sound card. I hit this bug during ADSP crash/reboot test case on Dragon board DB410c. Without this patch, on SLAB Poisoning enabled build, kernel crashes with "BUG kmalloc-128 (Tainted: G W ): Poison overwritten" Signed-off-by: Srinivas Kandagatla <[email protected]> Signed-off-by: Mark Brown <[email protected]> Cc: [email protected]
imcsk8 · Jun 4, 2018 · ff2faf1 · ff2faf1
1 parent 0c24fdc
commit ff2faf1
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
@@ -433,6 +433,8 @@ static int dapm_kcontrol_data_alloc(struct snd_soc_dapm_widget *widget,
 static void dapm_kcontrol_free(struct snd_kcontrol *kctl)
 {
 	struct dapm_kcontrol_data *data = snd_kcontrol_chip(kctl);
+
+	list_del(&data->paths);
 	kfree(data->wlist);
 	kfree(data);
 }