From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752794Ab1FNF2r (ORCPT ); Tue, 14 Jun 2011 01:28:47 -0400 Received: from cantor2.suse.de ([195.135.220.15]:50624 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752195Ab1FNF2m (ORCPT ); Tue, 14 Jun 2011 01:28:42 -0400 Date: Tue, 14 Jun 2011 07:28:36 +0200 Message-ID: From: Takashi Iwai To: Jesper Juhl Cc: linux-kernel@vger.kernel.org, alsa-devel@alsa-project.org, Daniel Mack , Lucas De Marchi , Torsten Schenk , Jaroslav Kysela Subject: Re: [PATCH] Sound, 6Fire USB: Fix double-free bug in usb6fire_fw_ezusb_upload() In-Reply-To: References: User-Agent: Wanderlust/2.15.6 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.7 Emacs/23.2 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org At Mon, 13 Jun 2011 23:52:02 +0200 (CEST), Jesper Juhl wrote: > > We have a double-free bug in > sound/usb/6fire/firmware.c::usb6fire_fw_ezusb_upload(). > We already call release_firmware(fw) on line 258, so when we then do it > again after usb6fire_fw_ezusb_write() returns <0, we have a double-free. > Easily fixed by just removing the last call to release_firmware(). > > Signed-off-by: Jesper Juhl Applied now. Thanks. Takashi > --- > firmware.c | 1 - > 1 file changed, 1 deletion(-) > > Patch against Linus' tree (head at 40779859de0f73b40390c6401a024d06cf024290). > > diff --git a/sound/usb/6fire/firmware.c b/sound/usb/6fire/firmware.c > index a91719d..1e3ae33 100644 > --- a/sound/usb/6fire/firmware.c > +++ b/sound/usb/6fire/firmware.c > @@ -270,7 +270,6 @@ static int usb6fire_fw_ezusb_upload( > data = 0x00; /* resume ezusb cpu */ > ret = usb6fire_fw_ezusb_write(device, 0xa0, 0xe600, &data, 1); > if (ret < 0) { > - release_firmware(fw); > snd_printk(KERN_ERR PREFIX "unable to upload ezusb " > "firmware %s: end message.\n", fwname); > return ret; > > > -- > Jesper Juhl http://www.chaosbits.net/ > Don't top-post http://www.catb.org/jargon/html/T/top-post.html > Plain text mails only, please. >