From 2fd43d1159d22395aae01836c4b13ee5265a9b6b Mon Sep 17 00:00:00 2001
From: Clemens Ladisch <clemens@ladisch.de>
Date: Wed, 12 Oct 2005 17:10:35 +0200
Subject: [PATCH] [ALSA] timer: fix timer instance memory allocation checks

Modules: Timer Midlevel

Add checks to return -ENOMEM in case snd_timer_instance_new() fails.

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
---
 sound/core/timer.c | 42 ++++++++++++++++++++++++------------------
 1 file changed, 24 insertions(+), 18 deletions(-)

diff --git a/sound/core/timer.c b/sound/core/timer.c
index 8ecec9134a..b02681eaea 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -251,6 +251,10 @@ int snd_timer_open(snd_timer_instance_t **ti,
 		}
 		down(&register_mutex);
 		timeri = snd_timer_instance_new(owner, NULL);
+		if (!timeri) {
+			up(&register_mutex);
+			return -ENOMEM;
+		}
 		timeri->slave_class = tid->dev_sclass;
 		timeri->slave_id = tid->device;
 		timeri->flags |= SNDRV_TIMER_IFLG_SLAVE;
@@ -272,27 +276,29 @@ int snd_timer_open(snd_timer_instance_t **ti,
 		timer = snd_timer_find(tid);
 	}
 #endif
-	if (timer) {
-		if (!list_empty(&timer->open_list_head)) {
-			timeri = (snd_timer_instance_t *)list_entry(timer->open_list_head.next, snd_timer_instance_t, open_list);
-			if (timeri->flags & SNDRV_TIMER_IFLG_EXCLUSIVE) {
-				up(&register_mutex);
-				return -EBUSY;
-			}
-		}
-		timeri = snd_timer_instance_new(owner, timer);
-		if (timeri) {
-			timeri->slave_class = tid->dev_sclass;
-			timeri->slave_id = slave_id;
-			if (list_empty(&timer->open_list_head) && timer->hw.open)
-				timer->hw.open(timer);
-			list_add_tail(&timeri->open_list, &timer->open_list_head);
-			snd_timer_check_master(timeri);
-		}
-	} else {
+	if (!timer) {
 		up(&register_mutex);
 		return -ENODEV;
 	}
+	if (!list_empty(&timer->open_list_head)) {
+		timeri = list_entry(timer->open_list_head.next,
+				    snd_timer_instance_t, open_list);
+		if (timeri->flags & SNDRV_TIMER_IFLG_EXCLUSIVE) {
+			up(&register_mutex);
+			return -EBUSY;
+		}
+	}
+	timeri = snd_timer_instance_new(owner, timer);
+	if (!timeri) {
+		up(&register_mutex);
+		return -ENOMEM;
+	}
+	timeri->slave_class = tid->dev_sclass;
+	timeri->slave_id = slave_id;
+	if (list_empty(&timer->open_list_head) && timer->hw.open)
+		timer->hw.open(timer);
+	list_add_tail(&timeri->open_list, &timer->open_list_head);
+	snd_timer_check_master(timeri);
 	up(&register_mutex);
 	*ti = timeri;
 	return 0;
-- 
2.39.5