Commit 1d0eb614 authored by Takashi Iwai's avatar Takashi Iwai
Browse files

ALSA: ymfpci: Fix the missing snd_card_free() call at probe error 



Like a few other drivers, YMFPCI driver needs to clean up with
snd_card_free() call at an error path of the probe; otherwise the
other devres resources are released before the card and it results in
the UAF.

This patch uses the helper for handling the probe error gracefully.

Fixes: f33fc157 ("ALSA: ymfpci: Create card with device-managed snd_devm_card_new()")
Cc: <stable@vger.kernel.org>
Reported-and-tested-by: default avatarTakashi Yano <takashi.yano@nifty.ne.jp>
Closes: https://lore.kernel.org/r/20230823135846.1812-1-takashi.yano@nifty.ne.jp
Link: https://lore.kernel.org/r/20230823161625.5807-1-tiwai@suse.de


Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 46cdff23

sound/pci/ymfpci/ymfpci.c

+8 −2
Original line number Diff line number Diff line
@@ -152,7 +152,7 @@ static inline int snd_ymfpci_create_gameport(struct snd_ymfpci *chip, int dev, i 
void snd_ymfpci_free_gameport(struct snd_ymfpci *chip) { }

#endif /* SUPPORT_JOYSTICK */



static int snd_card_ymfpci_probe(struct pci_dev *pci,

static int __snd_card_ymfpci_probe(struct pci_dev *pci,

				   const struct pci_device_id *pci_id)

{

	static int dev;
@@ -348,6 +348,12 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci, 
	return 0;

}



static int snd_card_ymfpci_probe(struct pci_dev *pci,

				 const struct pci_device_id *pci_id)

{

	return snd_card_free_on_error(&pci->dev, __snd_card_ymfpci_probe(pci, pci_id));

}



static struct pci_driver ymfpci_driver = {

	.name = KBUILD_MODNAME,

	.id_table = snd_ymfpci_ids,