[PATCH 1/4] ALSA: jack: Fix kctl free at error in snd_jack_kctl_new()
From: Takashi Iwai
Date: Tue Oct 13 2026 - 08:21:44 EST
When an error happens in snd_jack_kctl_new(), it tries to free the new
kcontrol element via snd_ctl_free_one(). But snd_ctl_free_one()
releases only the memories, and the internal linked list and hash
entries still remain, which may lead to bogus accesses to user.
Replace with the correct destructor, snd_ctl_remove(), for clearing
the whole resources of the given kcontrol, instead.
Fixes: 9058cbe1eed2 ("ALSA: jack: implement kctl creating for jack devices")
Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
---
sound/core/jack.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/core/jack.c b/sound/core/jack.c
index 5cc9c42de981..d9132b885ea3 100644
--- a/sound/core/jack.c
+++ b/sound/core/jack.c
@@ -453,7 +453,7 @@ static struct snd_jack_kctl * snd_jack_kctl_new(struct snd_card *card, const cha
return jack_kctl;
error:
- snd_ctl_free_one(kctl);
+ snd_ctl_remove(card, kctl);
return NULL;
}
--
2.55.0