Skip to content

Commit 1d0eb61

Browse files
committed
ALSA: ymfpci: Fix the missing snd_card_free() call at probe error
Like a few other drivers, YMFPCI driver needs to clean up with snd_card_free() call at an error path of the probe; otherwise the other devres resources are released before the card and it results in the UAF. This patch uses the helper for handling the probe error gracefully. Fixes: f33fc15 ("ALSA: ymfpci: Create card with device-managed snd_devm_card_new()") Cc: <stable@vger.kernel.org> Reported-and-tested-by: Takashi Yano <takashi.yano@nifty.ne.jp> Closes: https://lore.kernel.org/r/20230823135846.1812-1-takashi.yano@nifty.ne.jp Link: https://lore.kernel.org/r/20230823161625.5807-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de>
1 parent 46cdff2 commit 1d0eb61

File tree

1 file changed

+8
-2
lines changed

1 file changed

+8
-2
lines changed

sound/pci/ymfpci/ymfpci.c

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -152,8 +152,8 @@ static inline int snd_ymfpci_create_gameport(struct snd_ymfpci *chip, int dev, i
152152
void snd_ymfpci_free_gameport(struct snd_ymfpci *chip) { }
153153
#endif /* SUPPORT_JOYSTICK */
154154

155-
static int snd_card_ymfpci_probe(struct pci_dev *pci,
156-
const struct pci_device_id *pci_id)
155+
static int __snd_card_ymfpci_probe(struct pci_dev *pci,
156+
const struct pci_device_id *pci_id)
157157
{
158158
static int dev;
159159
struct snd_card *card;
@@ -348,6 +348,12 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci,
348348
return 0;
349349
}
350350

351+
static int snd_card_ymfpci_probe(struct pci_dev *pci,
352+
const struct pci_device_id *pci_id)
353+
{
354+
return snd_card_free_on_error(&pci->dev, __snd_card_ymfpci_probe(pci, pci_id));
355+
}
356+
351357
static struct pci_driver ymfpci_driver = {
352358
.name = KBUILD_MODNAME,
353359
.id_table = snd_ymfpci_ids,

0 commit comments

Comments
 (0)