diff options
| author | Zhao Dongdong <zhaodongdong@kylinos.cn> | 2026-05-27 20:09:13 +0800 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2026-05-28 09:36:23 +0200 |
| commit | c205bd1b28fb7e5f1061a4e78813fad7d315cb3e (patch) | |
| tree | 506bcce713869ed29e1fc5917445763811216769 /sound | |
| parent | e64d170346d00b580c0043de3e5ccb3e331c47d4 (diff) | |
| download | linux-next-history-c205bd1b28fb7e5f1061a4e78813fad7d315cb3e.tar.gz | |
ALSA: cmipci: check snd_ctl_new1() return value
snd_ctl_new1() can return NULL when memory allocation fails.
snd_cmipci_spdif_controls() does not check the return value before
dereferencing kctl->id.device, which can lead to a NULL pointer
dereference.
Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any
fails.
Assisted-by: Opencode:DeepSeek-V4-Flash
Cc: stable@vger.kernel.org
Fixes: f2f312ad88c6 ("ALSA: cmipci: Fix kctl->id initialization")
Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
Link: https://patch.msgid.link/tencent_964433DCD132125D5EDA79EE068A2D6EFA09@qq.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/pci/cmipci.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/sound/pci/cmipci.c b/sound/pci/cmipci.c index f5382b10865a3..9d9f784e3a8c1 100644 --- a/sound/pci/cmipci.c +++ b/sound/pci/cmipci.c @@ -2637,16 +2637,22 @@ static int snd_cmipci_mixer_new(struct cmipci *cm, int pcm_spdif_device) } if (cm->can_ac3_hw) { kctl = snd_ctl_new1(&snd_cmipci_spdif_default, cm); + if (!kctl) + return -ENOMEM; kctl->id.device = pcm_spdif_device; err = snd_ctl_add(card, kctl); if (err < 0) return err; kctl = snd_ctl_new1(&snd_cmipci_spdif_mask, cm); + if (!kctl) + return -ENOMEM; kctl->id.device = pcm_spdif_device; err = snd_ctl_add(card, kctl); if (err < 0) return err; kctl = snd_ctl_new1(&snd_cmipci_spdif_stream, cm); + if (!kctl) + return -ENOMEM; kctl->id.device = pcm_spdif_device; err = snd_ctl_add(card, kctl); if (err < 0) |