From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753446AbdIFVwz (ORCPT ); Wed, 6 Sep 2017 17:52:55 -0400 Received: from aserp1040.oracle.com ([141.146.126.69]:34428 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752501AbdIFVwx (ORCPT ); Wed, 6 Sep 2017 17:52:53 -0400 Date: Thu, 7 Sep 2017 00:51:20 +0300 From: Dan Carpenter To: SF Markus Elfring Cc: alsa-devel@alsa-project.org, Bhumika Goyal , David Howells , Ingo Molnar , Jaroslav Kysela , Takashi Iwai , LKML , kernel-janitors@vger.kernel.org Subject: Re: [PATCH 1/3] ALSA: ymfpci: Use common error handling code in snd_card_ymfpci_probe() Message-ID: <20170906215120.m7ifun3doq5famva@mwanda> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: NeoMutt/20170113 (1.7.2) X-Source-IP: aserv0022.oracle.com [141.146.126.234] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Sep 06, 2017 at 09:46:52PM +0200, SF Markus Elfring wrote: > @@ -336,21 +331,24 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci, > legacy_ctrl &= ~YMFPCI_LEGACY_FMEN; > pci_write_config_word(pci, PCIR_DSXG_LEGACY, legacy_ctrl); > } else if ((err = snd_opl3_hwdep_new(opl3, 0, 1, NULL)) < 0) { > - snd_card_free(card); ^^^^^^^^^^^^^^^^^^^ > dev_err(card->dev, "cannot create opl3 hwdep\n"); ^^^^^^^^^ > - return err; > + goto free_card; Heh. I was worried that some of these re-orderings would introduce bugs but actually this one fixes a use after free. regards, dan carpenter From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Date: Wed, 06 Sep 2017 21:51:20 +0000 Subject: Re: [PATCH 1/3] ALSA: ymfpci: Use common error handling code in snd_card_ymfpci_probe() Message-Id: <20170906215120.m7ifun3doq5famva@mwanda> List-Id: References: In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: SF Markus Elfring Cc: alsa-devel@alsa-project.org, LKML , kernel-janitors@vger.kernel.org, Takashi Iwai , David Howells , Ingo Molnar , Bhumika Goyal On Wed, Sep 06, 2017 at 09:46:52PM +0200, SF Markus Elfring wrote: > @@ -336,21 +331,24 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci, > legacy_ctrl &= ~YMFPCI_LEGACY_FMEN; > pci_write_config_word(pci, PCIR_DSXG_LEGACY, legacy_ctrl); > } else if ((err = snd_opl3_hwdep_new(opl3, 0, 1, NULL)) < 0) { > - snd_card_free(card); ^^^^^^^^^^^^^^^^^^^ > dev_err(card->dev, "cannot create opl3 hwdep\n"); ^^^^^^^^^ > - return err; > + goto free_card; Heh. I was worried that some of these re-orderings would introduce bugs but actually this one fixes a use after free. regards, dan carpenter From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Subject: Re: [PATCH 1/3] ALSA: ymfpci: Use common error handling code in snd_card_ymfpci_probe() Date: Thu, 7 Sep 2017 00:51:20 +0300 Message-ID: <20170906215120.m7ifun3doq5famva@mwanda> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) by alsa0.perex.cz (Postfix) with ESMTP id CC9972673FE for ; Wed, 6 Sep 2017 23:51:45 +0200 (CEST) Content-Disposition: inline In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: alsa-devel-bounces@alsa-project.org Sender: alsa-devel-bounces@alsa-project.org To: SF Markus Elfring Cc: alsa-devel@alsa-project.org, LKML , kernel-janitors@vger.kernel.org, Takashi Iwai , David Howells , Ingo Molnar , Bhumika Goyal List-Id: alsa-devel@alsa-project.org On Wed, Sep 06, 2017 at 09:46:52PM +0200, SF Markus Elfring wrote: > @@ -336,21 +331,24 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci, > legacy_ctrl &= ~YMFPCI_LEGACY_FMEN; > pci_write_config_word(pci, PCIR_DSXG_LEGACY, legacy_ctrl); > } else if ((err = snd_opl3_hwdep_new(opl3, 0, 1, NULL)) < 0) { > - snd_card_free(card); ^^^^^^^^^^^^^^^^^^^ > dev_err(card->dev, "cannot create opl3 hwdep\n"); ^^^^^^^^^ > - return err; > + goto free_card; Heh. I was worried that some of these re-orderings would introduce bugs but actually this one fixes a use after free. regards, dan carpenter