Commit e67d64e8 authored Oct 19, 2018 by Hemant Kumar

sound: usb: Fix use after free in driver probe



In case of an error condition snd_card_free() is called
if chip->num_interfaces is zero. snd_card_free() frees
chip instance by calling snd_usb_audio_free(). chip->active
is being decremented after freeing chip instance resulting
into use after free. Hence decrement chip->active only if
chip->num_interfaces is non-zero.

Change-Id: I74784cab930bf9d74432226f8a0db33cfb869b30
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>

parent c7aa41f5

sound/usb/card.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -743,6 +743,7 @@ static int usb_audio_probe(struct usb_interface *intf,
		if (chip) {
		if (!chip->num_interfaces)
		snd_card_free(chip->card);
		else
		atomic_dec(&chip->active);
		}
		mutex_unlock(&register_mutex);