Commit e5092c96 authored by Daniel Mack's avatar Daniel Mack Committed by Mark Brown
Browse files

ASoC: soc-dapm: fix use after free 



Coverity spotted the following possible use-after-free condition in
dapm_create_or_share_mixmux_kcontrol():

If kcontrol is NULL, and (wname_in_long_name && kcname_in_long_name)
validates to true, 'name' will be set to an allocated string, and be
freed a few lines later via the 'long_name' alias. 'name', however,
is used by dev_err() in case snd_ctl_add() fails.

Fix this by adding a jump label that frees 'long_name' at the end of
the function.

Signed-off-by: default avatarDaniel Mack <daniel@zonque.org>
Signed-off-by: default avatarMark Brown <broonie@kernel.org>
Cc: stable@vger.kernel.org
parent a5448c88

sound/soc/soc-dapm.c

+14 −11
Original line number Diff line number Diff line
@@ -592,9 +592,9 @@ static int dapm_create_or_share_mixmux_kcontrol(struct snd_soc_dapm_widget *w, 
	int shared;

	struct snd_kcontrol *kcontrol;

	bool wname_in_long_name, kcname_in_long_name;

	char *long_name;

	char *long_name = NULL;

	const char *name;

	int ret;

	int ret = 0;



	prefix = soc_dapm_prefix(dapm);

	if (prefix)
@@ -653,15 +653,17 @@ static int dapm_create_or_share_mixmux_kcontrol(struct snd_soc_dapm_widget *w, 


		kcontrol = snd_soc_cnew(&w->kcontrol_news[kci], NULL, name,

					prefix);

		kfree(long_name);

		if (!kcontrol)

			return -ENOMEM;

		if (!kcontrol) {

			ret = -ENOMEM;

			goto exit_free;

		}



		kcontrol->private_free = dapm_kcontrol_free;



		ret = dapm_kcontrol_data_alloc(w, kcontrol);

		if (ret) {

			snd_ctl_free_one(kcontrol);

			return ret;

			goto exit_free;

		}



		ret = snd_ctl_add(card, kcontrol);
@@ -669,17 +671,18 @@ static int dapm_create_or_share_mixmux_kcontrol(struct snd_soc_dapm_widget *w, 
			dev_err(dapm->dev,

				"ASoC: failed to add widget %s dapm kcontrol %s: %d\n",

				w->name, name, ret);

			return ret;

			goto exit_free;

		}

	}



	ret = dapm_kcontrol_add_widget(kcontrol, w);

	if (ret)

		return ret;



	if (ret == 0)

		w->kcontrols[kci] = kcontrol;



	return 0;

exit_free:

	kfree(long_name);



	return ret;

}



/* create new dapm mixer control */

CRA Git | Maintained and supported by SUSTech CRA and CCSE