summaryrefslogtreecommitdiff
path: root/sound
diff options
context:
space:
mode:
authorColin Ian King <colin.king@canonical.com>2016-12-09 14:17:47 +0000
committerMark Brown <broonie@kernel.org>2016-12-15 11:36:37 +0000
commitc2b36129ce53a22b89dd2b88db33e7ffdefe0f41 (patch)
tree4e1d391586c745f556793f2b64a0bf9e041dba26 /sound
parenta5de5b74a50113564a1e0850e2da96c37c35e55d (diff)
ASoC: topology: kfree kcontrol->private_value before freeing kcontrol
kcontrol->private_value is being kfree'd after kcontrol has been freed (in previous call to snd_ctl_remove). Instead, fix this by kfreeing the private_value before kcontrol. CoverityScan CID#1388311 "Read from pointer after free" Fixes: eea3dd4f1247a ("ASoC: topology: Only free TLV for volume mixers of a widget") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'sound')
-rw-r--r--sound/soc/soc-topology.c3
1 files changed, 1 insertions, 2 deletions
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
index 65670b2b408c..fbfb1fab88d5 100644
--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -514,13 +514,12 @@ static void remove_widget(struct snd_soc_component *comp,
== SND_SOC_TPLG_TYPE_MIXER)
kfree(kcontrol->tlv.p);
- snd_ctl_remove(card, kcontrol);
-
/* Private value is used as struct soc_mixer_control
* for volume mixers or soc_bytes_ext for bytes
* controls.
*/
kfree((void *)kcontrol->private_value);
+ snd_ctl_remove(card, kcontrol);
}
kfree(w->kcontrol_news);
}