![]() In wm2000_i2c_probe(), if we take the true branch in " ret = snd_soc_register_codec(&i2c->dev, &soc_codec_dev_wm2000, NULL, 0); if (ret != 0) goto err_fw; " then we'll release_firmware(fw) at the 'err_fw' label. But we've already done that just a few lines above. That's a use-after-free bug. This patch restructures the code so that we always call release_firmware(fw) before leaving the function, but only ever call it once. This means that we have to initialize 'fw' to NULL since some paths may now end up calling it without having called request_firmware(), but since request_firmware() deals gracefully with NULL pointers, we are fine if we just NULL initialize it. Signed-off-by: Jesper Juhl <jj@chaosbits.net> Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com> |
||
---|---|---|
.. | ||
aoa | ||
arm | ||
atmel | ||
core | ||
drivers | ||
firewire | ||
i2c | ||
isa | ||
mips | ||
oss | ||
parisc | ||
pci | ||
pcmcia | ||
ppc | ||
sh | ||
soc | ||
sparc | ||
spi | ||
synth | ||
usb | ||
ac97_bus.c | ||
Kconfig | ||
last.c | ||
Makefile | ||
sound_core.c | ||
sound_firmware.c |