aboutsummaryrefslogtreecommitdiffstats
path: root/sound/usb
diff options
context:
space:
mode:
authorJesper Juhl <jj@chaosbits.net>2011-06-13 17:52:02 -0400
committerTakashi Iwai <tiwai@suse.de>2011-06-14 01:27:26 -0400
commit37f7ec38ea5c31180461f82e895e13fdd549b595 (patch)
treeedabbd3298390da475ea280030c1cf870aac8818 /sound/usb
parent2308f4add3de9f6c9c9f02e49461e94d84bb200a (diff)
ALSA: 6fire: Fix double-free bug in usb6fire_fw_ezusb_upload()
We have a double-free bug in sound/usb/6fire/firmware.c::usb6fire_fw_ezusb_upload(). We already call release_firmware(fw) on line 258, so when we then do it again after usb6fire_fw_ezusb_write() returns <0, we have a double-free. Easily fixed by just removing the last call to release_firmware(). Signed-off-by: Jesper Juhl <jj@chaosbits.net> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/usb')
-rw-r--r--sound/usb/6fire/firmware.c1
1 files changed, 0 insertions, 1 deletions
diff --git a/sound/usb/6fire/firmware.c b/sound/usb/6fire/firmware.c
index a91719d5918b..1e3ae3327dd3 100644
--- a/sound/usb/6fire/firmware.c
+++ b/sound/usb/6fire/firmware.c
@@ -270,7 +270,6 @@ static int usb6fire_fw_ezusb_upload(
270 data = 0x00; /* resume ezusb cpu */ 270 data = 0x00; /* resume ezusb cpu */
271 ret = usb6fire_fw_ezusb_write(device, 0xa0, 0xe600, &data, 1); 271 ret = usb6fire_fw_ezusb_write(device, 0xa0, 0xe600, &data, 1);
272 if (ret < 0) { 272 if (ret < 0) {
273 release_firmware(fw);
274 snd_printk(KERN_ERR PREFIX "unable to upload ezusb " 273 snd_printk(KERN_ERR PREFIX "unable to upload ezusb "
275 "firmware %s: end message.\n", fwname); 274 "firmware %s: end message.\n", fwname);
276 return ret; 275 return ret;