| Message ID | YGcDETcdqVUIl1+y@mwanda |
|---|---|
| State | New |
| Headers | show |
| Series | [1/2] ALSA: control - fix a leak in snd_ctl_led_init() | expand |
Dne 02. 04. 21 v 13:42 Dan Carpenter napsal(a): > This unwind loop needs to free snd_ctl_leds[0] as well. > > Fixes: cb17fe0045aa ("ALSA: control - add sysfs support to the LED trigger module") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > sound/core/control_led.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/sound/core/control_led.c b/sound/core/control_led.c > index d4fb8b873f34..202b475d0bf3 100644 > --- a/sound/core/control_led.c > +++ b/sound/core/control_led.c > @@ -712,7 +712,7 @@ static struct snd_ctl_layer_ops snd_ctl_led_lops = { > static int __init snd_ctl_led_init(void) > { > struct snd_ctl_led *led; > - unsigned int group; > + int group; > > device_initialize(&snd_ctl_led_dev); > snd_ctl_led_dev.class = sound_class; > @@ -730,7 +730,7 @@ static int __init snd_ctl_led_init(void) > dev_set_name(&led->dev, led->name); > if (device_add(&led->dev)) { > put_device(&led->dev); > - for (; group > 0; group--) { > + for (; group >= 0; group--) { > led = &snd_ctl_leds[group]; It's not correct. This assignent should be 'led = &snd_ctl_leds[group - 1];' without other changes, because the put_device() is enough when device_add() fails. Could you resend the correction? Jaroslav > device_del(&led->dev); > } >
On Fri, 09 Apr 2021 14:34:41 +0200, Dan Carpenter wrote: > > "group - 1" was intended here instead of "group". The current error > handling will double free the first item in the array and leak the last > item. > > Fixes: cb17fe0045aa ("ALSA: control - add sysfs support to the LED trigger module") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > v2: The first patch wasn't right. It fixed the leak but left the double > free. Applied now. Thanks. Takashi
diff --git a/sound/core/control_led.c b/sound/core/control_led.c index d4fb8b873f34..202b475d0bf3 100644 --- a/sound/core/control_led.c +++ b/sound/core/control_led.c @@ -712,7 +712,7 @@ static struct snd_ctl_layer_ops snd_ctl_led_lops = { static int __init snd_ctl_led_init(void) { struct snd_ctl_led *led; - unsigned int group; + int group; device_initialize(&snd_ctl_led_dev); snd_ctl_led_dev.class = sound_class; @@ -730,7 +730,7 @@ static int __init snd_ctl_led_init(void) dev_set_name(&led->dev, led->name); if (device_add(&led->dev)) { put_device(&led->dev); - for (; group > 0; group--) { + for (; group >= 0; group--) { led = &snd_ctl_leds[group]; device_del(&led->dev); }
This unwind loop needs to free snd_ctl_leds[0] as well. Fixes: cb17fe0045aa ("ALSA: control - add sysfs support to the LED trigger module") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- sound/core/control_led.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)