From 57b138dde3504b79358cd0d95d989bf5eba8280b Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Fri, 9 Apr 2021 15:34:41 +0300 Subject: ALSA: control - double free in snd_ctl_led_init() "group - 1" was intended here instead of "group". The current error handling will double free the first item in the array and leak the last item. Fixes: cb17fe0045aa ("ALSA: control - add sysfs support to the LED trigger module") Signed-off-by: Dan Carpenter Reviewed-by: Jaroslav Kysela Link: https://lore.kernel.org/r/YHBJ4frGxErWB182@mwanda Signed-off-by: Takashi Iwai --- sound/core/control_led.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'sound/core') diff --git a/sound/core/control_led.c b/sound/core/control_led.c index d756a52e58db..93b201063c7d 100644 --- a/sound/core/control_led.c +++ b/sound/core/control_led.c @@ -734,7 +734,7 @@ static int __init snd_ctl_led_init(void) if (device_add(&led->dev)) { put_device(&led->dev); for (; group > 0; group--) { - led = &snd_ctl_leds[group]; + led = &snd_ctl_leds[group - 1]; device_del(&led->dev); } device_del(&snd_ctl_led_dev); -- cgit v1.2.3