git: bca6f391aed9 - stable/14 - sound: Prevent uninitialized variable destruction in chn_init()
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Tue, 21 May 2024 17:53:55 UTC
The branch stable/14 has been updated by christos: URL: https://cgit.FreeBSD.org/src/commit/?id=bca6f391aed9ecc01d6b7f496ddb6a17311e4c2c commit bca6f391aed9ecc01d6b7f496ddb6a17311e4c2c Author: Christos Margiolis <christos@FreeBSD.org> AuthorDate: 2024-05-20 14:14:25 +0000 Commit: Christos Margiolis <christos@FreeBSD.org> CommitDate: 2024-05-21 17:45:41 +0000 sound: Prevent uninitialized variable destruction in chn_init() If dsp_unit2name() fails, we'll get to out2 with b, bs and devinfo uninitialized, which will result in a panic. Reported by: Pierre Pronchery <pierre@freebsdfoundation.org> Reported by: Coverity Scan CID: 1545029, 1545025 Pull-request: https://github.com/freebsd/freebsd-src/pull/1240 Sponsored by: The FreeBSD Foundation MFC after: 1 day Reviewed by: markj Differential Revision: https://reviews.freebsd.org/D45272 (cherry picked from commit 5d1a5d6f1f599a4fbea9634cbe5c77f7370e1a5d) --- sys/dev/sound/pcm/channel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/dev/sound/pcm/channel.c b/sys/dev/sound/pcm/channel.c index 039d9abb9da2..a18ef1cf4234 100644 --- a/sys/dev/sound/pcm/channel.c +++ b/sys/dev/sound/pcm/channel.c @@ -1236,6 +1236,8 @@ chn_init(struct snddev_info *d, struct pcm_channel *parent, kobj_class_t cls, } PCM_UNLOCK(d); + b = NULL; + bs = NULL; c = malloc(sizeof(*c), M_DEVBUF, M_WAITOK | M_ZERO); c->methods = kobj_create(cls, M_DEVBUF, M_WAITOK | M_ZERO); c->type = type; @@ -1257,8 +1259,6 @@ chn_init(struct snddev_info *d, struct pcm_channel *parent, kobj_class_t cls, snprintf(c->name, sizeof(c->name), "%s:%s:%s", device_get_nameunit(c->dev), dirs, devname); - b = NULL; - bs = NULL; CHN_INIT(c, children); CHN_INIT(c, children.busy); c->latency = -1;