diff options
| author |   Daniel Mack <daniel@zonque.org> | 2014-10-07 13:41:24 +0200 |
|---|---|---|
| committer |   Mark Brown <broonie@kernel.org> | 2014-10-07 13:11:35 +0100 |
| commit | e5092c96c9c28f4d12811edcd02ca8eec16e748e (patch) | |
| tree | 67be9d9351f59ab72e9f93242908190ad9c79ae4 /sound | |
| parent | Merge remote-tracking branches 'asoc/topic/txx9', 'asoc/topic/wm8978' and 'asoc/topic/wm8994' into asoc-next (diff) | |
| download | linux-dev-e5092c96c9c28f4d12811edcd02ca8eec16e748e.tar.xz linux-dev-e5092c96c9c28f4d12811edcd02ca8eec16e748e.zip | |
ASoC: soc-dapm: fix use after free
Coverity spotted the following possible use-after-free condition in
dapm_create_or_share_mixmux_kcontrol():
If kcontrol is NULL, and (wname_in_long_name && kcname_in_long_name)
validates to true, 'name' will be set to an allocated string, and be
freed a few lines later via the 'long_name' alias. 'name', however,
is used by dev_err() in case snd_ctl_add() fails.
Fix this by adding a jump label that frees 'long_name' at the end of
the function.
Signed-off-by: Daniel Mack <daniel@zonque.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/soc/soc-dapm.c | 25 |
1 files changed, 14 insertions, 11 deletions
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c index 2c456a376ade..c61cb9cedbcd 100644 --- a/sound/soc/soc-dapm.c +++ b/sound/soc/soc-dapm.c @@ -592,9 +592,9 @@ static int dapm_create_or_share_mixmux_kcontrol(struct snd_soc_dapm_widget *w, int shared; struct snd_kcontrol *kcontrol; bool wname_in_long_name, kcname_in_long_name; - char *long_name; + char *long_name = NULL; const char *name; - int ret; + int ret = 0; prefix = soc_dapm_prefix(dapm); if (prefix) @@ -653,15 +653,17 @@ static int dapm_create_or_share_mixmux_kcontrol(struct snd_soc_dapm_widget *w, kcontrol = snd_soc_cnew(&w->kcontrol_news[kci], NULL, name, prefix); - kfree(long_name); - if (!kcontrol) - return -ENOMEM; + if (!kcontrol) { + ret = -ENOMEM; + goto exit_free; + } + kcontrol->private_free = dapm_kcontrol_free; ret = dapm_kcontrol_data_alloc(w, kcontrol); if (ret) { snd_ctl_free_one(kcontrol); - return ret; + goto exit_free; } ret = snd_ctl_add(card, kcontrol); @@ -669,17 +671,18 @@ static int dapm_create_or_share_mixmux_kcontrol(struct snd_soc_dapm_widget *w, dev_err(dapm->dev, "ASoC: failed to add widget %s dapm kcontrol %s: %d\n", w->name, name, ret); - return ret; + goto exit_free; } } ret = dapm_kcontrol_add_widget(kcontrol, w); - if (ret) - return ret; + if (ret == 0) + w->kcontrols[kci] = kcontrol; - w->kcontrols[kci] = kcontrol; +exit_free: + kfree(long_name); - return 0; + return ret; } /* create new dapm mixer control */ |