diff options
| author | Colin Ian King <colin.king@canonical.com> | 2016-12-09 14:17:47 +0000 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2016-12-15 11:36:37 +0000 |
| commit | c2b36129ce53a22b89dd2b88db33e7ffdefe0f41 (patch) | |
| tree | 4e1d391586c745f556793f2b64a0bf9e041dba26 /sound | |
| parent | a5de5b74a50113564a1e0850e2da96c37c35e55d (diff) | |
| download | linux-c2b36129ce53a22b89dd2b88db33e7ffdefe0f41.tar.bz2 | |
ASoC: topology: kfree kcontrol->private_value before freeing kcontrol
kcontrol->private_value is being kfree'd after kcontrol has been freed
(in previous call to snd_ctl_remove). Instead, fix this by kfreeing
the private_value before kcontrol.
CoverityScan CID#1388311 "Read from pointer after free"
Fixes: eea3dd4f1247a ("ASoC: topology: Only free TLV for volume mixers of a widget")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/soc/soc-topology.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c index 65670b2b408c..fbfb1fab88d5 100644 --- a/sound/soc/soc-topology.c +++ b/sound/soc/soc-topology.c @@ -514,13 +514,12 @@ static void remove_widget(struct snd_soc_component *comp, == SND_SOC_TPLG_TYPE_MIXER) kfree(kcontrol->tlv.p); - snd_ctl_remove(card, kcontrol); - /* Private value is used as struct soc_mixer_control * for volume mixers or soc_bytes_ext for bytes * controls. */ kfree((void *)kcontrol->private_value); + snd_ctl_remove(card, kcontrol); } kfree(w->kcontrol_news); } |