[PATCH] alsa: fix error paths in snd_ctl_elem_add()
authorTakashi Iwai <takashi.iwai@gmail.com>
Mon, 6 Mar 2006 23:42:51 +0000 (15:42 -0800)
committerLinus Torvalds <torvalds@g5.osdl.org>
Tue, 7 Mar 2006 02:40:44 +0000 (18:40 -0800)
Fix bugs in error paths of snd_ctl_elem_add()
 - NULL reference
 - double free (already freed in snd_ctl_add())

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Cc: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
sound/core/control.c

index abd62f9437267bcb2addeb0a0d6f311264aa112b..0c29679a8576b0dee6d913c5282f72d02fbd1d78 100644 (file)
@@ -959,17 +959,15 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
        kctl.private_free = snd_ctl_elem_user_free;
        _kctl = snd_ctl_new(&kctl, access);
        if (_kctl == NULL) {
-               kfree(_kctl->private_data);
+               kfree(ue);
                return -ENOMEM;
        }
        _kctl->private_data = ue;
        for (idx = 0; idx < _kctl->count; idx++)
                _kctl->vd[idx].owner = file;
        err = snd_ctl_add(card, _kctl);
-       if (err < 0) {
-               snd_ctl_free_one(_kctl);
+       if (err < 0)
                return err;
-       }
 
        down_write(&card->controls_rwsem);
        card->user_ctl_count++;