[PATCH] ASoC: Intel: bytcr_rt5640: Fix use-after-free in snd_byt_rt5640_mc_probe()

[Wentao Liang]

When the device found by name is not an i2c_client, the reference taken
by bus_find_device_by_name() is dropped, but execution continues with
the stale codec_dev pointer, which is stored in priv->codec_dev and
dereferenced later in the probe.

The device is not usable as the codec, so return an error after dropping
the reference.

Fixes: d48696b91552 ("ASoC: Intel: bytcr_rt5640: Add support for non ACPI instantiated codec")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 sound/soc/intel/boards/bytcr_rt5640.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
index 40da3eea5fa7..557486c6f28d 100644
--- a/sound/soc/intel/boards/bytcr_rt5640.c
+++ b/sound/soc/intel/boards/bytcr_rt5640.c
@@ -1764,6 +1764,7 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev)
 			dev_err(dev, "Error '%s' is not an i2c_client\n",
 				BYT_RT5640_FALLBACK_CODEC_DEV_NAME);
 			put_device(codec_dev);
+			return -ENODEV;
 		}
 
 		/* fixup codec name */
-- 
2.34.1