From: Takashi Iwai Date: Mon, 6 Sep 2010 07:13:45 +0000 (+0200) Subject: ALSA: seq/oss - Fix double-free at error path of snd_seq_oss_open() X-Git-Tag: v2.6.27.54~11 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d0d3c686c7cb5a1b4d75df7fd76cae0d80f657a4;p=pandora-kernel.git ALSA: seq/oss - Fix double-free at error path of snd_seq_oss_open() commit 27f7ad53829f79e799a253285318bff79ece15bd upstream. The error handling in snd_seq_oss_open() has several bad codes that do dereferecing released pointers and double-free of kmalloc'ed data. The object dp is release in free_devinfo() that is called via private_free callback. The rest shouldn't touch this object any more. The patch changes delete_port() to call kfree() in any case, and gets rid of unnecessary calls of destructors in snd_seq_oss_open(). Fixes CVE-2010-3080. Reported-and-tested-by: Tavis Ormandy Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- Reading git-diff-tree failed