Skip to content
Commit c83f1d7e authored by Jesper Juhl's avatar Jesper Juhl Committed by Mark Brown
Browse files

ASoC: wm2000: Fix use-after-free - don't release_firmware() twice on error



In wm2000_i2c_probe(), if we take the true branch in

"
  ret = snd_soc_register_codec(&i2c->dev, &soc_codec_dev_wm2000,
                               NULL, 0);
  if (ret != 0)
          goto err_fw;
"

then we'll release_firmware(fw) at the 'err_fw' label. But we've already
done that just a few lines above. That's a use-after-free bug.

This patch restructures the code so that we always call
release_firmware(fw) before leaving the function, but only ever call
it once.
This means that we have to initialize 'fw' to NULL since some paths
may now end up calling it without having called request_firmware(),
but since request_firmware() deals gracefully with NULL pointers, we
are fine if we just NULL initialize it.

Signed-off-by: default avatarJesper Juhl <jj@chaosbits.net>
Signed-off-by: default avatarMark Brown <broonie@opensource.wolfsonmicro.com>
parent 7edf1a4f
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment