p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

ASoC: soc-dapm: fix use after free 

Coverity spotted the following possible use-after-free condition in
dapm_create_or_share_mixmux_kcontrol():

If kcontrol is NULL, and (wname_in_long_name && kcname_in_long_name)
validates to true, 'name' will be set to an allocated string, and be
freed a few lines later via the 'long_name' alias. 'name', however,
is used by dev_err() in case snd_ctl_add() fails.

Fix this by adding a jump label that frees 'long_name' at the end of
the function.

Signed-off-by: Daniel Mack <daniel@zonque.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
This commit is contained in:
Daniel Mack 2014-10-07 13:41:24 +02:00 committed by Mark Brown
parent a5448c88b8
commit e5092c96c9
1 changed files with 14 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
sound/soc/soc-dapm.c
View File

@ -592,9 +592,9 @@ static int dapm_create_or_share_mixmux_kcontrol(struct snd_soc_dapm_widget *w,
int shared;
struct snd_kcontrol *kcontrol;
bool wname_in_long_name, kcname_in_long_name;
char *long_name;
char *long_name = NULL;
const char *name;
int ret;
int ret = 0;
prefix = soc_dapm_prefix(dapm);
if (prefix)
@ -653,15 +653,17 @@ static int dapm_create_or_share_mixmux_kcontrol(struct snd_soc_dapm_widget *w,
kcontrol = snd_soc_cnew(&w->kcontrol_news[kci], NULL, name,
prefix);
kfree(long_name);
if (!kcontrol)
return -ENOMEM;
if (!kcontrol) {
ret = -ENOMEM;
goto exit_free;
}
kcontrol->private_free = dapm_kcontrol_free;
ret = dapm_kcontrol_data_alloc(w, kcontrol);
if (ret) {
snd_ctl_free_one(kcontrol);
return ret;
goto exit_free;
}
ret = snd_ctl_add(card, kcontrol);
@ -669,17 +671,18 @@ static int dapm_create_or_share_mixmux_kcontrol(struct snd_soc_dapm_widget *w,
dev_err(dapm->dev,
"ASoC: failed to add widget %s dapm kcontrol %s: %d\n",
w->name, name, ret);
return ret;
goto exit_free;
}
}
ret = dapm_kcontrol_add_widget(kcontrol, w);
if (ret)
return ret;
if (ret == 0)
w->kcontrols[kci] = kcontrol;
w->kcontrols[kci] = kcontrol;
exit_free:
kfree(long_name);
return 0;
return ret;
}
/* create new dapm mixer control */