audiod: Close filters in reverse order.

Otherwise, a subsequent filter might refer to a buffer reference of
the previous filter, accessing freed memory. This is not a bug right
now, as audiod only closes filters after the full buffer tree has
become inactive, i.e. after all buffer tree nodes have unregistered
their task. It's cleaner to reverse the loop though, and it has no
additional cost.

diff --git a/audiod.c b/audiod.c
index 8552af6b07d2d4d977fe4f0587c552c42f1bf038..8f2a72ac8700ee0699c19d78724cbe1d6ec61296 100644 (file)
--- a/audiod.c
+++ b/audiod.c
@@ -428,7 +428,7 @@ static void close_filters(struct slot_info *s)
        struct audio_format_info *a = afi + s->format;
        if (a->num_filters == 0)
                return;
        struct audio_format_info *a = afi + s->format;
        if (a->num_filters == 0)
                return;

-       for (i = 0; i < a->num_filters; i++) {
+       for (i = a->num_filters - 1; i >= 0; i--) {

                struct filter_node *fn = s->fns + i;
                struct filter *f;
 
                struct filter_node *fn = s->fns + i;
                struct filter *f;