Commit 2fbf182e authored by Takashi Iwai's avatar Takashi Iwai Committed by Linus Torvalds

[PATCH] alsa: fix error paths in snd_ctl_elem_add()

Fix bugs in error paths of snd_ctl_elem_add()
 - NULL reference
 - double free (already freed in snd_ctl_add())
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Cc: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 5aee405c
...@@ -959,17 +959,15 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, ...@@ -959,17 +959,15 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
kctl.private_free = snd_ctl_elem_user_free; kctl.private_free = snd_ctl_elem_user_free;
_kctl = snd_ctl_new(&kctl, access); _kctl = snd_ctl_new(&kctl, access);
if (_kctl == NULL) { if (_kctl == NULL) {
kfree(_kctl->private_data); kfree(ue);
return -ENOMEM; return -ENOMEM;
} }
_kctl->private_data = ue; _kctl->private_data = ue;
for (idx = 0; idx < _kctl->count; idx++) for (idx = 0; idx < _kctl->count; idx++)
_kctl->vd[idx].owner = file; _kctl->vd[idx].owner = file;
err = snd_ctl_add(card, _kctl); err = snd_ctl_add(card, _kctl);
if (err < 0) { if (err < 0)
snd_ctl_free_one(_kctl);
return err; return err;
}
down_write(&card->controls_rwsem); down_write(&card->controls_rwsem);
card->user_ctl_count++; card->user_ctl_count++;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment