mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-05 00:20:32 +00:00
ALSA: sb: Fix potential double-free of CSP mixer elements
[ Upstream commit c305366a37
]
snd_sb_qsound_destroy() contains the calls of removing the previously
created mixer controls, but it doesn't clear the pointers. As
snd_sb_qsound_destroy() itself may be repeatedly called via ioctl,
this could lead to double-free potentially.
Fix it by clearing the struct fields properly afterwards.
Link: https://lore.kernel.org/r/20210608140540.17885-4-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
b359cb3d33
commit
fd3ec5aec8
1 changed files with 6 additions and 2 deletions
|
@ -1086,10 +1086,14 @@ static void snd_sb_qsound_destroy(struct snd_sb_csp * p)
|
|||
card = p->chip->card;
|
||||
|
||||
down_write(&card->controls_rwsem);
|
||||
if (p->qsound_switch)
|
||||
if (p->qsound_switch) {
|
||||
snd_ctl_remove(card, p->qsound_switch);
|
||||
if (p->qsound_space)
|
||||
p->qsound_switch = NULL;
|
||||
}
|
||||
if (p->qsound_space) {
|
||||
snd_ctl_remove(card, p->qsound_space);
|
||||
p->qsound_space = NULL;
|
||||
}
|
||||
up_write(&card->controls_rwsem);
|
||||
|
||||
/* cancel pending transfer of QSound parameters */
|
||||
|
|
Loading…
Reference in a new issue