From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Subject: [patch] ASoC: sgtl5000: use after free in ldo_regulator_register() Date: Tue, 8 Mar 2011 14:39:24 +0300 Message-ID: <20110308113924.GC3416@bicker> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mail-fx0-f51.google.com (mail-fx0-f51.google.com [209.85.161.51]) by alsa0.perex.cz (Postfix) with ESMTP id 1C70B10381E for ; Tue, 8 Mar 2011 12:39:54 +0100 (CET) Received: by fxm11 with SMTP id 11so5072457fxm.38 for ; Tue, 08 Mar 2011 03:39:53 -0800 (PST) Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: alsa-devel-bounces@alsa-project.org Errors-To: alsa-devel-bounces@alsa-project.org To: Liam Girdwood Cc: alsa-devel@alsa-project.org, Zeng Zhaoming , Takashi Iwai , Mark Brown , kernel-janitors@vger.kernel.org List-Id: alsa-devel@alsa-project.org The "ldo" variable was dereferenced after free on the error path. Signed-off-by: Dan Carpenter diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c index b7e97c0..1f7217f 100644 --- a/sound/soc/codecs/sgtl5000.c +++ b/sound/soc/codecs/sgtl5000.c @@ -875,11 +875,13 @@ static int ldo_regulator_register(struct snd_soc_codec *codec, ldo->dev = regulator_register(&ldo->desc, codec->dev, init_data, ldo); if (IS_ERR(ldo->dev)) { + int ret = PTR_ERR(ldo->dev); + dev_err(codec->dev, "failed to register regulator\n"); kfree(ldo->desc.name); kfree(ldo); - return PTR_ERR(ldo->dev); + return ret; } return 0; From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Date: Tue, 08 Mar 2011 11:39:24 +0000 Subject: [patch] ASoC: sgtl5000: use after free in ldo_regulator_register() Message-Id: <20110308113924.GC3416@bicker> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Liam Girdwood Cc: alsa-devel@alsa-project.org, Zeng Zhaoming , Takashi Iwai , Mark Brown , kernel-janitors@vger.kernel.org The "ldo" variable was dereferenced after free on the error path. Signed-off-by: Dan Carpenter diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c index b7e97c0..1f7217f 100644 --- a/sound/soc/codecs/sgtl5000.c +++ b/sound/soc/codecs/sgtl5000.c @@ -875,11 +875,13 @@ static int ldo_regulator_register(struct snd_soc_codec *codec, ldo->dev = regulator_register(&ldo->desc, codec->dev, init_data, ldo); if (IS_ERR(ldo->dev)) { + int ret = PTR_ERR(ldo->dev); + dev_err(codec->dev, "failed to register regulator\n"); kfree(ldo->desc.name); kfree(ldo); - return PTR_ERR(ldo->dev); + return ret; } return 0;