diff options
author | Jesper Juhl <jj@chaosbits.net> | 2011-06-13 17:52:02 -0400 |
---|---|---|
committer | Takashi Iwai <tiwai@suse.de> | 2011-06-14 01:27:26 -0400 |
commit | 37f7ec38ea5c31180461f82e895e13fdd549b595 (patch) | |
tree | edabbd3298390da475ea280030c1cf870aac8818 /sound/usb | |
parent | 2308f4add3de9f6c9c9f02e49461e94d84bb200a (diff) |
ALSA: 6fire: Fix double-free bug in usb6fire_fw_ezusb_upload()
We have a double-free bug in
sound/usb/6fire/firmware.c::usb6fire_fw_ezusb_upload().
We already call release_firmware(fw) on line 258, so when we then do it
again after usb6fire_fw_ezusb_write() returns <0, we have a double-free.
Easily fixed by just removing the last call to release_firmware().
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/usb')
-rw-r--r-- | sound/usb/6fire/firmware.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/sound/usb/6fire/firmware.c b/sound/usb/6fire/firmware.c index a91719d5918b..1e3ae3327dd3 100644 --- a/sound/usb/6fire/firmware.c +++ b/sound/usb/6fire/firmware.c | |||
@@ -270,7 +270,6 @@ static int usb6fire_fw_ezusb_upload( | |||
270 | data = 0x00; /* resume ezusb cpu */ | 270 | data = 0x00; /* resume ezusb cpu */ |
271 | ret = usb6fire_fw_ezusb_write(device, 0xa0, 0xe600, &data, 1); | 271 | ret = usb6fire_fw_ezusb_write(device, 0xa0, 0xe600, &data, 1); |
272 | if (ret < 0) { | 272 | if (ret < 0) { |
273 | release_firmware(fw); | ||
274 | snd_printk(KERN_ERR PREFIX "unable to upload ezusb " | 273 | snd_printk(KERN_ERR PREFIX "unable to upload ezusb " |
275 | "firmware %s: end message.\n", fwname); | 274 | "firmware %s: end message.\n", fwname); |
276 | return ret; | 275 | return ret; |