• Wenwen Wang's avatar
    ALSA: usx2y: fix a double free bug · cbb88db7
    Wenwen Wang authored
    In usX2Y_In04_init(), a new urb is firstly created through usb_alloc_urb()
    and saved to 'usX2Y->In04urb'. Then, a buffer is allocated through
    kmalloc() and saved to 'usX2Y->In04Buf'. If the allocation of the buffer
    fails, the error code ENOMEM is returned after usb_free_urb(), which frees
    the created urb. However, the urb is actually freed at card->private_free
    callback, i.e., snd_usX2Y_card_private_free(). So the free operation here
    leads to a double free bug.
    
    To fix the above issue, simply remove usb_free_urb().
    Signed-off-by: default avatarWenwen Wang <wang6495@umn.edu>
    Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
    cbb88db7
usbusx2y.c 13.4 KB