Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 104326f8 authored by Florin Malita's avatar Florin Malita Committed by Jaroslav Kysela
Browse files

[ALSA] Dereference after free in snd_hwdep_release() 



snd_card_file_remove() may free hw->card so we can't dereference
hw->card->module after that.
Coverity ID 1420.

Signed-off-by: default avatarFlorin Malita <fmalita@gmail.com>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarJaroslav Kysela <perex@suse.cz>
parent 92b93d31

sound/core/hwdep.c

+2 −1
Original line number Original line Diff line number Diff line
@@ -158,6 +158,7 @@ static int snd_hwdep_release(struct inode *inode, struct file * file) 
{

{

	int err = -ENXIO;

	int err = -ENXIO;

	struct snd_hwdep *hw = file->private_data;

	struct snd_hwdep *hw = file->private_data;

	struct module *mod = hw->card->module;

	mutex_lock(&hw->open_mutex);

	mutex_lock(&hw->open_mutex);

	if (hw->ops.release) {

	if (hw->ops.release) {

		err = hw->ops.release(hw, file);

		err = hw->ops.release(hw, file);
@@ -167,7 +168,7 @@ static int snd_hwdep_release(struct inode *inode, struct file * file) 
		hw->used--;

		hw->used--;

	snd_card_file_remove(hw->card, file);

	snd_card_file_remove(hw->card, file);

	mutex_unlock(&hw->open_mutex);

	mutex_unlock(&hw->open_mutex);

	module_put(hw->card->module);

	module_put(mod);

	return err;

	return err;

}

}