Commit 3194642e authored by Chuhong Yuan's avatar Chuhong Yuan Committed by Yang Yingliang
Browse files

media: go7007: fix a miss of snd_card_free 



mainline inclusion
from mainline-v5.6-rc1
commit 9453264e
category: bugfix
bugzilla: NA
CVE: CVE-2019-20810

---------------------------

go7007_snd_init() misses a snd_card_free() in an error path.
Add the missed call to fix it.

Signed-off-by: default avatarChuhong Yuan <hslester96@gmail.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Reviewed-by: default avatarJason Yan <yanaijie@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parent 3f0d1cdd

drivers/media/usb/go7007/snd-go7007.c

+17 −18
Original line number Diff line number Diff line
@@ -244,22 +244,18 @@ int go7007_snd_init(struct go7007 *go) 
	gosnd->capturing = 0;

	ret = snd_card_new(go->dev, index[dev], id[dev], THIS_MODULE, 0,

			   &gosnd->card);

	if (ret < 0) {

		kfree(gosnd);

		return ret;

	}

	if (ret < 0)

		goto free_snd;



	ret = snd_device_new(gosnd->card, SNDRV_DEV_LOWLEVEL, go,

			&go7007_snd_device_ops);

	if (ret < 0) {

		kfree(gosnd);

		return ret;

	}

	if (ret < 0)

		goto free_card;



	ret = snd_pcm_new(gosnd->card, "go7007", 0, 0, 1, &gosnd->pcm);

	if (ret < 0) {

		snd_card_free(gosnd->card);

		kfree(gosnd);

		return ret;

	}

	if (ret < 0)

		goto free_card;



	strlcpy(gosnd->card->driver, "go7007", sizeof(gosnd->card->driver));

	strlcpy(gosnd->card->shortname, go->name, sizeof(gosnd->card->driver));

	strlcpy(gosnd->card->longname, gosnd->card->shortname,
@@ -270,11 +266,8 @@ int go7007_snd_init(struct go7007 *go) 
			&go7007_snd_capture_ops);



	ret = snd_card_register(gosnd->card);

	if (ret < 0) {

		snd_card_free(gosnd->card);

		kfree(gosnd);

		return ret;

	}

	if (ret < 0)

		goto free_card;



	gosnd->substream = NULL;

	go->snd_context = gosnd;
@@ -282,6 +275,12 @@ int go7007_snd_init(struct go7007 *go) 
	++dev;



	return 0;



free_card:

	snd_card_free(gosnd->card);

free_snd:

	kfree(gosnd);

	return ret;

}

EXPORT_SYMBOL(go7007_snd_init);