]> git.karo-electronics.de Git - karo-tx-linux.git/commit
ASoC: wm2000: Fix use-after-free - don't release_firmware() twice on error
authorJesper Juhl <jj@chaosbits.net>
Mon, 23 Jan 2012 21:28:44 +0000 (22:28 +0100)
committerMark Brown <broonie@opensource.wolfsonmicro.com>
Tue, 24 Jan 2012 11:34:19 +0000 (11:34 +0000)
commitc83f1d7e71625801c72f4013291194e09b6f0a6e
tree1bf7303f85769c1a60e95d697ed7a7ab02c44b0d
parent7edf1a4f27f44588d69cbde955651990090eb25d
ASoC: wm2000: Fix use-after-free - don't release_firmware() twice on error

In wm2000_i2c_probe(), if we take the true branch in

"
  ret = snd_soc_register_codec(&i2c->dev, &soc_codec_dev_wm2000,
                               NULL, 0);
  if (ret != 0)
          goto err_fw;
"

then we'll release_firmware(fw) at the 'err_fw' label. But we've already
done that just a few lines above. That's a use-after-free bug.

This patch restructures the code so that we always call
release_firmware(fw) before leaving the function, but only ever call
it once.
This means that we have to initialize 'fw' to NULL since some paths
may now end up calling it without having called request_firmware(),
but since request_firmware() deals gracefully with NULL pointers, we
are fine if we just NULL initialize it.

Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
sound/soc/codecs/wm2000.c