Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a9712783 authored by Manu Gautam's avatar Manu Gautam Committed by Matt Wagantall
Browse files

usb: gadget: audio: Don't access params after freeing it 



Free params after it is accessed to fix use after free
condition.

Change-Id: I77171db51a10ce220bc6382a4d03dcde6f2b7e4c
Signed-off-by: default avatarManu Gautam <mgautam@codeaurora.org>
parent 695aacaa

drivers/usb/gadget/function/u_uac1.c

+2 −2
Original line number Diff line number Diff line
@@ -277,11 +277,10 @@ static int capture_prepare_params(struct gaudio_snd_dev *snd) 


	runtime->frame_bits = snd_pcm_format_physical_width(runtime->format);



	kfree(params);



	swparams = kzalloc(sizeof(*swparams), GFP_KERNEL);

	if (!swparams) {

		pr_err("Failed to allocate sw params");

		kfree(params);

		return -ENOMEM;

	}
@@ -304,6 +303,7 @@ static int capture_prepare_params(struct gaudio_snd_dev *snd) 
			"SNDRV_PCM_IOCTL_SW_PARAMS failed: %d\n", (int)result);



	kfree(swparams);

	kfree(params);



	INFO(snd->card,

		"capture params: access %x, format %x, channels %d, rate %d\n",