From 2fbf182ed00a71c35e53329c2010df2baf8a89c6 Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Mon, 6 Mar 2006 15:42:51 -0800 Subject: [PATCH] [PATCH] alsa: fix error paths in snd_ctl_elem_add() Fix bugs in error paths of snd_ctl_elem_add() - NULL reference - double free (already freed in snd_ctl_add()) Signed-off-by: Takashi Iwai Cc: Jaroslav Kysela Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- sound/core/control.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/sound/core/control.c b/sound/core/control.c index abd62f9..0c29679 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -959,17 +959,15 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, kctl.private_free = snd_ctl_elem_user_free; _kctl = snd_ctl_new(&kctl, access); if (_kctl == NULL) { - kfree(_kctl->private_data); + kfree(ue); return -ENOMEM; } _kctl->private_data = ue; for (idx = 0; idx < _kctl->count; idx++) _kctl->vd[idx].owner = file; err = snd_ctl_add(card, _kctl); - if (err < 0) { - snd_ctl_free_one(_kctl); + if (err < 0) return err; - } down_write(&card->controls_rwsem); card->user_ctl_count++; -- 2.7.4