diff options
| author | Ruoyu Wang <ruoyuw560@gmail.com> | 2026-07-08 22:33:38 +0800 |
|---|---|---|
| committer | Hans Verkuil <hverkuil+cisco@kernel.org> | 2026-07-15 17:12:55 +0200 |
| commit | 3a7d6b9c4cb5ac18cbd3f1c7f8c7b159c42ba0b1 (patch) | |
| tree | 619c5e9c34217b4c4e3eec0afe80d5cc17e2dc09 /drivers | |
| parent | ae15adeed9f7ec54989175fe3c9e0815186821bc (diff) | |
| download | linux-next-3a7d6b9c4cb5ac18cbd3f1c7f8c7b159c42ba0b1.tar.gz linux-next-3a7d6b9c4cb5ac18cbd3f1c7f8c7b159c42ba0b1.zip | |
media: cobalt: Avoid freeing ALSA private data twice
snd_cobalt_card_create() stores cobsc in sc->private_data and installs
snd_cobalt_card_private_free() as sc->private_free. From that point,
snd_card_free(sc) releases cobsc through the ALSA card cleanup path.
If cobalt_alsa_init() fails after snd_cobalt_card_create(), the
err_exit_free path calls snd_card_free(sc) and then kfree(cobsc). That
second free releases the same object again.
Remove the explicit kfree(cobsc) and leave ownership with the ALSA card.
This issue was found by a static analysis checker and confirmed by
manual source review.
Fixes: 85756a069c55 ("[media] cobalt: add new driver")
Cc: stable@vger.kernel.org
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/media/pci/cobalt/cobalt-alsa-main.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/drivers/media/pci/cobalt/cobalt-alsa-main.c b/drivers/media/pci/cobalt/cobalt-alsa-main.c index 7bb7f13c70c0..9ed547cd40af 100644 --- a/drivers/media/pci/cobalt/cobalt-alsa-main.c +++ b/drivers/media/pci/cobalt/cobalt-alsa-main.c @@ -135,7 +135,6 @@ int cobalt_alsa_init(struct cobalt_stream *s) err_exit_free: if (sc != NULL) snd_card_free(sc); - kfree(cobsc); err_exit: return ret; } |