ALSA: control - double free in snd_ctl_led_init()

"group - 1" was intended here instead of "group".  The current error
handling will double free the first item in the array and leak the last
item.

Fixes: cb17fe0045aa ("ALSA: control - add sysfs support to the LED trigger module")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Link: https://lore.kernel.org/r/YHBJ4frGxErWB182@mwanda
Signed-off-by: Takashi Iwai <tiwai@suse.de>

diff --git a/sound/core/control_led.c b/sound/core/control_led.c
index d756a52e58db7aeb05fc97bc37659273a72d2561..93b201063c7da59de73fc364ad5644c251c6664e 100644 (file)
--- a/sound/core/control_led.c
+++ b/sound/core/control_led.c
@@ -734,7 +734,7 @@ static int __init snd_ctl_led_init(void)
                if (device_add(&led->dev)) {
                        put_device(&led->dev);
                        for (; group > 0; group--) {
-                               led = &snd_ctl_leds[group];
+                               led = &snd_ctl_leds[group - 1];
                                device_del(&led->dev);
                        }
                        device_del(&snd_ctl_led_dev);