Commit 57b138dd authored by Dan Carpenter's avatar Dan Carpenter Committed by Takashi Iwai

ALSA: control - double free in snd_ctl_led_init()

"group - 1" was intended here instead of "group".  The current error
handling will double free the first item in the array and leak the last
item.

Fixes: cb17fe00 ("ALSA: control - add sysfs support to the LED trigger module")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarJaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/YHBJ4frGxErWB182@mwandaSigned-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 64f40f9b
...@@ -734,7 +734,7 @@ static int __init snd_ctl_led_init(void) ...@@ -734,7 +734,7 @@ static int __init snd_ctl_led_init(void)
if (device_add(&led->dev)) { if (device_add(&led->dev)) {
put_device(&led->dev); put_device(&led->dev);
for (; group > 0; group--) { for (; group > 0; group--) {
led = &snd_ctl_leds[group]; led = &snd_ctl_leds[group - 1];
device_del(&led->dev); device_del(&led->dev);
} }
device_del(&snd_ctl_led_dev); device_del(&snd_ctl_led_dev);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment