From b737fd8cf196bc96e471304007c3cd9b78672069 Mon Sep 17 00:00:00 2001
From: Libin Yang <libin.yang@intel.com>
Date: Fri, 8 Jul 2022 15:05:15 -0500
Subject: [PATCH] ASoC: SOF: ipc4-topology: check dai->private in ipc_free()
Mime-version: 1.0
Content-type: text/plain; charset=UTF-8
Content-transfer-encoding: 8bit
Git-commit: b737fd8cf196bc96e471304007c3cd9b78672069
Patch-mainline: v6.0-rc1
References: jsc#PED-850

Set the swidget->private or dai->private to NULL after kfree in the error
handling in ipc_setup(). The private needs to be set NULL because if
ipc_setup() returns error, ipc_free() will be called later. ipc_free()
will judge the private is NULL or not to do the clearing.

For dai widget, dai->private is allocated and set in dai widget
ipc_setup(). So we need to check dai->private is NULL or not
in the ipc_free().

Fixes: 2cabd02b6090 ("ASoC: SOF: ipc4-topology: Add support for parsing AIF_IN/AIF_OUT widgets")
Fixes: abfb536bd116 ("ASoC: SOF: ipc4-topology: Add support for parsing DAI_IN/DAI_OUT widgets")
Fixes: 4f838ab20812 ("ASoC: SOF: ipc4-topology: Add support for parsing and preparing pga widgets")
Fixes: 4d4ba014ac4b ("ASoC: SOF: ipc4-topology: Add support for parsing mixer widgets")
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
Signed-off-by: Libin Yang <libin.yang@intel.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20220708200516.26853-2-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Acked-by: Takashi Iwai <tiwai@suse.de>

---
 sound/soc/sof/ipc4-topology.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/sound/soc/sof/ipc4-topology.c b/sound/soc/sof/ipc4-topology.c
index 34f805431f2e..2d157ea79db5 100644
--- a/sound/soc/sof/ipc4-topology.c
+++ b/sound/soc/sof/ipc4-topology.c
@@ -394,6 +394,7 @@ static int sof_ipc4_widget_setup_pcm(struct snd_sof_widget *swidget)
 	kfree(available_fmt->dma_buffer_size);
 free_copier:
 	kfree(ipc4_copier);
+	swidget->private = NULL;
 	return ret;
 }
 
@@ -541,6 +542,8 @@ static int sof_ipc4_widget_setup_comp_dai(struct snd_sof_widget *swidget)
 	kfree(available_fmt->dma_buffer_size);
 free_copier:
 	kfree(ipc4_copier);
+	dai->private = NULL;
+	dai->scomp = NULL;
 	return ret;
 }
 
@@ -553,6 +556,12 @@ static void sof_ipc4_widget_free_comp_dai(struct snd_sof_widget *swidget)
 	if (!dai)
 		return;
 
+	if (!dai->private) {
+		kfree(dai);
+		swidget->private = NULL;
+		return;
+	}
+
 	ipc4_copier = dai->private;
 	available_fmt = &ipc4_copier->available_fmt;
 
@@ -669,6 +678,7 @@ static int sof_ipc4_widget_setup_comp_pga(struct snd_sof_widget *swidget)
 	return 0;
 err:
 	kfree(gain);
+	swidget->private = NULL;
 	return ret;
 }
 
@@ -698,6 +708,7 @@ static int sof_ipc4_widget_setup_comp_mixer(struct snd_sof_widget *swidget)
 	return 0;
 err:
 	kfree(mixer);
+	swidget->private = NULL;
 	return ret;
 }
 
-- 
2.35.3