Re: [PATCH] ASoC: audio-graph-card2: Fix use-after-free in audio_graph2_link_c2c()

[Kuninori Morimoto]

Hi Wentao

> of_graph_get_next_port() consumes the reference of its prev argument.
> port0 is only borrowed from the caller's iterator, so the call drops a
> reference the function does not own, and port0 is dereferenced again
> afterwards. Pass an extra reference, as graph_count_c2c() does, so the
> reference the callee consumes is the one taken here.
> 
> Fixes: 5f281c3e82b1 ("ASoC: audio-graph-card2: use __free(device_node) for device node")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
> ---
(snip)
> -	struct device_node *port1 __free(device_node) = of_graph_get_next_port(ports, port0);
> +	struct device_node *port1 __free(device_node) =
> +		of_graph_get_next_port(ports, of_node_get(port0));

Ah, yes indeed.

Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@xxxxxxxxxxx>


Thank you for your help !!

Best regards
---
Kuninori Morimoto