]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ASoC: soc-dapm: fix use after free
authorDaniel Mack <daniel@zonque.org>
Tue, 7 Oct 2014 11:41:24 +0000 (13:41 +0200)
committerJiri Slaby <jslaby@suse.cz>
Thu, 13 Nov 2014 18:02:08 +0000 (19:02 +0100)
commit9e5e18105b8ac7f8e5167f396c0eeb2aaef6e003
treef7c28e57d57beffb0afe037568ce66240c067a18
parentd525cbdb3d29308d900b0417ca38e70fe6c4c25a
ASoC: soc-dapm: fix use after free

commit e5092c96c9c28f4d12811edcd02ca8eec16e748e upstream.

Coverity spotted the following possible use-after-free condition in
dapm_create_or_share_mixmux_kcontrol():

If kcontrol is NULL, and (wname_in_long_name && kcname_in_long_name)
validates to true, 'name' will be set to an allocated string, and be
freed a few lines later via the 'long_name' alias. 'name', however,
is used by dev_err() in case snd_ctl_add() fails.

Fix this by adding a jump label that frees 'long_name' at the end of
the function.

Signed-off-by: Daniel Mack <daniel@zonque.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
sound/soc/soc-dapm.c