diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2021-04-09 15:34:41 +0300 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2021-04-09 17:15:20 +0300 |
| commit | 57b138dde3504b79358cd0d95d989bf5eba8280b (patch) | |
| tree | c64861f4dac963c47cca1fb8204a642ea6bb9c57 /sound/core | |
| parent | 64f40f9be14106e7df0098c427cb60be645bddb7 (diff) | |
| download | linux-57b138dde3504b79358cd0d95d989bf5eba8280b.tar.xz | |
ALSA: control - double free in snd_ctl_led_init()
"group - 1" was intended here instead of "group". The current error
handling will double free the first item in the array and leak the last
item.
Fixes: cb17fe0045aa ("ALSA: control - add sysfs support to the LED trigger module")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/YHBJ4frGxErWB182@mwanda
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/core')
| -rw-r--r-- | sound/core/control_led.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sound/core/control_led.c b/sound/core/control_led.c index d756a52e58db..93b201063c7d 100644 --- a/sound/core/control_led.c +++ b/sound/core/control_led.c @@ -734,7 +734,7 @@ static int __init snd_ctl_led_init(void) if (device_add(&led->dev)) { put_device(&led->dev); for (; group > 0; group--) { - led = &snd_ctl_leds[group]; + led = &snd_ctl_leds[group - 1]; device_del(&led->dev); } device_del(&snd_ctl_led_dev); |