snd_es18xx_mixer() creates controls with snd_ctl_new1() and then stores
hardware-volume bookkeeping in the returned control before calling
snd_ctl_add(). snd_ctl_new1() can return NULL on allocation failure, so
those private_free writes can dereference NULL before snd_ctl_add() gets a
chance to reject the missing control.
Check the returned control pointers before using them and return -ENOMEM
on allocation failure.
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
sound/isa/es18xx.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/sound/isa/es18xx.c b/sound/isa/es18xx.c
index 1da7b400a17b6..2f454f7797ce2 100644
--- a/sound/isa/es18xx.c
+++ b/sound/isa/es18xx.c
@@ -1762,6 +1762,8 @@ static int snd_es18xx_mixer(struct snd_card *card)
for (idx = 0; idx < ARRAY_SIZE(snd_es18xx_base_controls); idx++) {
struct snd_kcontrol *kctl;
kctl = snd_ctl_new1(&snd_es18xx_base_controls[idx], chip);
+ if (!kctl)
+ return -ENOMEM;
if (chip->caps & ES18XX_HWV) {
switch (idx) {
case 0:
@@ -1823,6 +1825,8 @@ static int snd_es18xx_mixer(struct snd_card *card)
for (idx = 0; idx < ARRAY_SIZE(snd_es18xx_hw_volume_controls); idx++) {
struct snd_kcontrol *kctl;
kctl = snd_ctl_new1(&snd_es18xx_hw_volume_controls[idx], chip);
+ if (!kctl)
+ return -ENOMEM;
if (idx == 0)
chip->hw_volume = kctl;
else
--
2.34.1