diff options
| author | Takashi Iwai | 2006-03-06 15:42:51 -0800 |
|---|---|---|
| committer | Linus Torvalds | 2006-03-06 18:40:44 -0800 |
| commit | 2fbf182ed00a71c35e53329c2010df2baf8a89c6 (patch) | |
| tree | 5b66a27b68a28b3b9f7e308519cc72315e69f4e7 | |
| parent | 5aee405c662ca644980c184774277fc6d0769a84 (diff) | |
[PATCH] alsa: fix error paths in snd_ctl_elem_add()
Fix bugs in error paths of snd_ctl_elem_add()
- NULL reference
- double free (already freed in snd_ctl_add())
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Cc: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
| -rw-r--r-- | sound/core/control.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/sound/core/control.c b/sound/core/control.c index abd62f943726..0c29679a8576 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -959,17 +959,15 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, kctl.private_free = snd_ctl_elem_user_free; _kctl = snd_ctl_new(&kctl, access); if (_kctl == NULL) { - kfree(_kctl->private_data); + kfree(ue); return -ENOMEM; } _kctl->private_data = ue; for (idx = 0; idx < _kctl->count; idx++) _kctl->vd[idx].owner = file; err = snd_ctl_add(card, _kctl); - if (err < 0) { - snd_ctl_free_one(_kctl); + if (err < 0) return err; - } down_write(&card->controls_rwsem); card->user_ctl_count++; |