diff options
| author | Florin Malita <fmalita@gmail.com> | 2006-09-29 12:55:25 +0200 |
|---|---|---|
| committer | Jaroslav Kysela <perex@suse.cz> | 2006-10-06 20:22:59 +0200 |
| commit | 104326f8df9925317cca64b84249d3eac5de7c74 (patch) | |
| tree | c97b00520884caf405da958c0f04b07ed21017f7 /sound/core | |
| parent | 92b93d31718a3ccbbcf911d2f570bb345c496d66 (diff) | |
| download | op-kernel-dev-104326f8df9925317cca64b84249d3eac5de7c74.zip op-kernel-dev-104326f8df9925317cca64b84249d3eac5de7c74.tar.gz | |
[ALSA] Dereference after free in snd_hwdep_release()
snd_card_file_remove() may free hw->card so we can't dereference
hw->card->module after that.
Coverity ID 1420.
Signed-off-by: Florin Malita <fmalita@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Diffstat (limited to 'sound/core')
| -rw-r--r-- | sound/core/hwdep.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c index 9aa9d94..46b4768 100644 --- a/sound/core/hwdep.c +++ b/sound/core/hwdep.c @@ -158,6 +158,7 @@ static int snd_hwdep_release(struct inode *inode, struct file * file) { int err = -ENXIO; struct snd_hwdep *hw = file->private_data; + struct module *mod = hw->card->module; mutex_lock(&hw->open_mutex); if (hw->ops.release) { err = hw->ops.release(hw, file); @@ -167,7 +168,7 @@ static int snd_hwdep_release(struct inode *inode, struct file * file) hw->used--; snd_card_file_remove(hw->card, file); mutex_unlock(&hw->open_mutex); - module_put(hw->card->module); + module_put(mod); return err; } |
