[PATCH] most: sound: Fix potential use-after-free on channel setup failure

[Guangshuo Li]

A failed channel setup releases the whole sound adapter, including
channels already linked to it. Later disconnects then use freed state.
Link the channel after PCM setup succeeds. On failure free the new
channel and release the adapter only if it has no other channels.

This issue was found by our static analysis tool under development.

Fixes: 15600aea2754 ("staging: most: sound: create one sound card w/ multiple PCM devices per MOST device")
Signed-off-by: Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx>
---
 drivers/most/most_snd.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/most/most_snd.c b/drivers/most/most_snd.c
index 68b9e6c64033..d4166c743057 100644
--- a/drivers/most/most_snd.c
+++ b/drivers/most/most_snd.c
@@ -584,27 +584,30 @@ static int audio_probe_channel(struct most_interface *iface, int channel_id,
 	channel->iface = iface;
 	channel->id = channel_id;
 	init_waitqueue_head(&channel->playback_waitq);
-	list_add_tail(&channel->list, &adpt->dev_list);
 
 	ret = audio_set_hw_params(&channel->pcm_hardware, ch_num, sample_res,
 				  cfg);
 	if (ret)
-		goto err_free_adpt;
+		goto err_free_channel;
 
 	ret = snd_pcm_new(adpt->card, device_name, adpt->pcm_dev_idx,
 			  playback_count, capture_count, &pcm);
 
 	if (ret < 0)
-		goto err_free_adpt;
+		goto err_free_channel;
 
 	pcm->private_data = channel;
 	strscpy(pcm->name, device_name, sizeof(pcm->name));
 	snd_pcm_set_ops(pcm, direction, &pcm_ops);
 	snd_pcm_set_managed_buffer_all(pcm, SNDRV_DMA_TYPE_VMALLOC, NULL, 0, 0);
+	list_add_tail(&channel->list, &adpt->dev_list);
 	return 0;
 
+err_free_channel:
+	kfree(channel);
 err_free_adpt:
-	release_adapter(adpt);
+	if (list_empty(&adpt->dev_list))
+		release_adapter(adpt);
 	return ret;
 }
 
-- 
2.43.0