diff mbox series

[1/2,v2] ALSA: control - double free in snd_ctl_led_init()

Message ID YHBJ4frGxErWB182@mwanda
State Accepted
Commit 57b138dde3504b79358cd0d95d989bf5eba8280b
Headers show
Series [1/2,v2] ALSA: control - double free in snd_ctl_led_init() | expand

Commit Message

Dan Carpenter April 9, 2021, 12:34 p.m. UTC 
"group - 1" was intended here instead of "group".  The current error
handling will double free the first item in the array and leak the last
item.

Fixes: cb17fe0045aa ("ALSA: control - add sysfs support to the LED trigger module")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
v2: The first patch wasn't right.  It fixed the leak but left the double
free.

 sound/core/control_led.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Takashi Iwai April 9, 2021, 2:16 p.m. UTC | #1 
On Fri, 09 Apr 2021 14:34:41 +0200,
Dan Carpenter wrote:
> 
> "group - 1" was intended here instead of "group".  The current error
> handling will double free the first item in the array and leak the last
> item.
> 
> Fixes: cb17fe0045aa ("ALSA: control - add sysfs support to the LED trigger module")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> v2: The first patch wasn't right.  It fixed the leak but left the double
> free.

Applied now.  Thanks.


Takashi
diff mbox series

Patch

diff --git a/sound/core/control_led.c b/sound/core/control_led.c
index d756a52e58db..93b201063c7d 100644
--- a/sound/core/control_led.c
+++ b/sound/core/control_led.c
@@ -734,7 +734,7 @@  static int __init snd_ctl_led_init(void)
 		if (device_add(&led->dev)) {
 			put_device(&led->dev);
 			for (; group > 0; group--) {
-				led = &snd_ctl_leds[group];
+				led = &snd_ctl_leds[group - 1];
 				device_del(&led->dev);
 			}
 			device_del(&snd_ctl_led_dev);