From: Takashi Iwai <takashi.iwai@gmail.com>
Date: Mon, 6 Mar 2006 23:42:51 +0000 (-0800)
Subject: [PATCH] alsa: fix error paths in snd_ctl_elem_add()
X-Git-Tag: v2.6.16-rc6~95
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2fbf182ed00a71c35e53329c2010df2baf8a89c6;p=linux-2.6

[PATCH] alsa: fix error paths in snd_ctl_elem_add()

Fix bugs in error paths of snd_ctl_elem_add()
 - NULL reference
 - double free (already freed in snd_ctl_add())

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Cc: Jaroslav Kysela <perex@suse.cz>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
---

diff --git a/sound/core/control.c b/sound/core/control.c
index abd62f9437..0c29679a85 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -959,17 +959,15 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
 	kctl.private_free = snd_ctl_elem_user_free;
 	_kctl = snd_ctl_new(&kctl, access);
 	if (_kctl == NULL) {
-		kfree(_kctl->private_data);
+		kfree(ue);
 		return -ENOMEM;
 	}
 	_kctl->private_data = ue;
 	for (idx = 0; idx < _kctl->count; idx++)
 		_kctl->vd[idx].owner = file;
 	err = snd_ctl_add(card, _kctl);
-	if (err < 0) {
-		snd_ctl_free_one(_kctl);
+	if (err < 0)
 		return err;
-	}
 
 	down_write(&card->controls_rwsem);
 	card->user_ctl_count++;