From nobody Mon Jun 8 04:15:53 2026 Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BF596367B84 for ; Sun, 7 Jun 2026 07:42:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780818147; cv=none; b=WsE82cNaE+iXs8XoZppl+atCkimnCavw1sI8Ff74VppWIl4bsMt+ESf2y23bAmXoSa10MUb7g61vC37DlXXi/kfAWWp/4QkOQ4jCWh/pW3YkjHBXcKA8Wy+1i81E+EzLATwEqn1poSXe2s5QWJRrZmYaejgF8qji43UbX/suzV8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780818147; c=relaxed/simple; bh=cETSxH6N8k4VJKEnZYyODhK/zPaA0KGxM0AkYi35j+I=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=q2lzw08QkCyEbbjMusp+0UnsGY+ZF2WmqD725oOUzRF0Xr9/kQMzEj+UuoeoJHiTCfXvTfrhDRVM7fZ+yeY3V/IxQh6QTI4RHXGbTkP1Zy8A3KCRu8aKhTTa3RpsC1CtjKQFfWOMkvKH95GsEGse8KDNi6iWIVMEMBv7KWkn6yU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=mdzAVg/g; arc=none smtp.client-ip=209.85.216.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="mdzAVg/g" Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-36b9b15af73so2907201a91.0 for ; Sun, 07 Jun 2026 00:42:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780818145; x=1781422945; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=szQBTLMM+ErJ/0yB+n97U9OvndRfVdMRJeYj292RBIY=; b=mdzAVg/gi1c1HHzkgYHZrQUn0KSAPCDku47hh6a2zMSJGVX6pv0YkSc8W4Gt17Fort utLuWXFuCjUnmXQ5sKzwWvCUcc7vW0IdkWIkc6Tb8WyvToLNPT4o4VNFMkSR0YklqHcE i3WdrjAQ+fiXotAs3ekwltJChr4JhTW+PQ8QlFdEvwdX7t8GVPZOqM0yHhew/CrkOSaS 4zSR1z8GqEPXiS3ys4RVu1E0atlKHY2zSGiiNGxEiAdEiMWq0izE8RjjrH9wNwV0WwKz lTCrlW2y+H9O7s1cGSUgJidmZBvPP5c55gvBRm6PNcg4X9N3Ii8oqRtUXFNN8ineX90r bu8g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780818145; x=1781422945; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=szQBTLMM+ErJ/0yB+n97U9OvndRfVdMRJeYj292RBIY=; b=aPUJoIYMeS5AfqPsY/RqYFrfBaEG+n2cxWyk4GRRTpRZrdez92F+D3WS204sa0OZir 1ea2v9JrJog90dOMIzEGDo4oAdW2vhJL2Z99Xs7oFF00H4Cg76uOqnlYuzwSI6imxFsP geJ2/cQ5yKwP6694mA0oh76h/jkm1Inu27PT42pGYxJn4+WLTeHuCXNaj3oE94C208IN UI89qIQT1hEw2hv2Y9pBpv1GEKBUQObbtz4gxKovjn9zzEO+npymhUJoTEbrR8an2+h4 ZZ3xSyjEPOUM+zwCisuwPLwgltO+1/O4ay9c2+5+Pi1WmCazuQwWjDVKiX3mvr7+Nnp9 zZGA== X-Forwarded-Encrypted: i=1; AFNElJ+03TJ7IXF+oOYqo5DZiwmYbn4Z2prZNNU2HboeWeLo8fyIgzBYGlnJhuEX2bkneAZXSL0jaxAU5Ub2h2k=@vger.kernel.org X-Gm-Message-State: AOJu0Yy7R1chbRMKDjLd0AKscFQWR7iSOMXp6e20wnwsKBRzyHkwpqo/ qOQbL/nHjoHrBpSZWJ7He2EHrNe1gJxEA63msIqgIkhC5KmRLShn8Mtu X-Gm-Gg: Acq92OF7wPoJWifM1BwQwpVcGdc+I0s6tUk5vG2uoSogSM07rsgZKiDbEFPKHhjv5gf IuMzBCUP7Fh0ozOg9YZQGaokqHQPEeisOcOWwlT7lvlj38igwUTYfqjk6e0zZ5aB1Hq5XDKin9W GwfUIH6NLbUWioyTvRotcnuyB29sIq3ygD0KPGd7B+Xfg4zn3QEocJxR5hS1p9wjiClCJRnLMh5 GjGhEoEzZIWTOUvMqI1npQA8Af50kMbWVSvQVS8dSbXPbWUeteqCMoPiu/z0wOi7l12bq1uwjhu o53ivaGMA8tayIDS6sy4WkhwGm2RDf7eWoaisc68xCr8ZBIQF5QMFjpa2OUXk1iAo1I5Ui+5LbY GNq5b7WgHdNczYtMDcF30fzm3z1ucvsUwl3b7RqASVkzR1YR9a4jhwYFCFVJoqNX2b05mVquDeG 8JzbFR15IGYDsPmETTIhZrfFsh1EYlMPc3/Sw2BBx/xq8IAo7C+lBe X-Received: by 2002:a17:90b:390b:b0:36b:3ecd:88d2 with SMTP id 98e67ed59e1d1-370eeb1bebamr11537085a91.3.1780818144906; Sun, 07 Jun 2026 00:42:24 -0700 (PDT) Received: from haichao.tail057a43.ts.net ([2001:da8:e000:1206:5d57:2cec:64ac:50a]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36f6ea172b8sm11903157a91.17.2026.06.07.00.42.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 07 Jun 2026 00:42:24 -0700 (PDT) From: Ruoyu Wang To: Takashi Iwai , Jaroslav Kysela Cc: linux-sound@vger.kernel.org, linux-kernel@vger.kernel.org, alsa-devel@alsa-project.org, Ruoyu Wang Subject: [PATCH v2] ALSA: es18xx: check control allocation before private data setup Date: Sun, 7 Jun 2026 15:42:19 +0800 Message-ID: <20260607074219.3-1-ruoyuw560@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" snd_es18xx_mixer() creates controls with snd_ctl_new1() and then stores bookkeeping pointers or sets private_free before calling snd_ctl_add(). snd_ctl_new1() can return NULL on allocation failure, so those writes can dereference a NULL control pointer. Check the returned control pointers before using them and return -ENOMEM on allocation failure. Signed-off-by: Ruoyu Wang --- v2: - Rebase on sound.git for-next. - Resend only es18xx; the other v1 patches are already in for-next. sound/isa/es18xx.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/sound/isa/es18xx.c b/sound/isa/es18xx.c index df88d91e0fb..1a02da1679d 100644 --- a/sound/isa/es18xx.c +++ b/sound/isa/es18xx.c @@ -1762,6 +1762,8 @@ static int snd_es18xx_mixer(struct snd_card *card) for (idx =3D 0; idx < ARRAY_SIZE(snd_es18xx_base_controls); idx++) { struct snd_kcontrol *kctl; kctl =3D snd_ctl_new1(&snd_es18xx_base_controls[idx], chip); + if (!kctl) + return -ENOMEM; if (chip->caps & ES18XX_HWV) { switch (idx) { case 0: @@ -1823,6 +1825,8 @@ static int snd_es18xx_mixer(struct snd_card *card) for (idx =3D 0; idx < ARRAY_SIZE(snd_es18xx_hw_volume_controls); idx++) { struct snd_kcontrol *kctl; kctl =3D snd_ctl_new1(&snd_es18xx_hw_volume_controls[idx], chip); + if (!kctl) + return -ENOMEM; if (idx =3D=3D 0) chip->hw_volume =3D kctl; else --=20 2.51.0