* ad1848 double free
@ 2006-03-06 8:58 Dave Jones
2006-03-06 13:52 ` Takashi Iwai
0 siblings, 1 reply; 2+ messages in thread
From: Dave Jones @ 2006-03-06 8:58 UTC (permalink / raw)
To: tiwai; +Cc: Linux Kernel
Same again, snd_ctl_add() already kfree's on error.
Coverity #956
Signed-off-by: Dave Jones <davej@redhat.com>
--- linux-2.6/sound/isa/ad1848/ad1848_lib.c~ 2006-03-06 03:57:22.000000000 -0500
+++ linux-2.6/sound/isa/ad1848/ad1848_lib.c 2006-03-06 03:57:30.000000000 -0500
@@ -1202,10 +1202,8 @@ int snd_ad1848_add_ctl(struct snd_ad1848
strlcpy(ctl->id.name, name, sizeof(ctl->id.name));
ctl->id.index = index;
ctl->private_value = value;
- if ((err = snd_ctl_add(chip->card, ctl)) < 0) {
- snd_ctl_free_one(ctl);
+ if ((err = snd_ctl_add(chip->card, ctl)) < 0)
return err;
- }
return 0;
}
--
http://www.codemonkey.org.uk
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: ad1848 double free
2006-03-06 8:58 ad1848 double free Dave Jones
@ 2006-03-06 13:52 ` Takashi Iwai
0 siblings, 0 replies; 2+ messages in thread
From: Takashi Iwai @ 2006-03-06 13:52 UTC (permalink / raw)
To: Dave Jones; +Cc: Linux Kernel
At Mon, 6 Mar 2006 03:58:18 -0500,
Dave Jones wrote:
>
> Same again, snd_ctl_add() already kfree's on error.
>
> Coverity #956
> Signed-off-by: Dave Jones <davej@redhat.com>
>
> --- linux-2.6/sound/isa/ad1848/ad1848_lib.c~ 2006-03-06 03:57:22.000000000 -0500
> +++ linux-2.6/sound/isa/ad1848/ad1848_lib.c 2006-03-06 03:57:30.000000000 -0500
> @@ -1202,10 +1202,8 @@ int snd_ad1848_add_ctl(struct snd_ad1848
> strlcpy(ctl->id.name, name, sizeof(ctl->id.name));
> ctl->id.index = index;
> ctl->private_value = value;
> - if ((err = snd_ctl_add(chip->card, ctl)) < 0) {
> - snd_ctl_free_one(ctl);
> + if ((err = snd_ctl_add(chip->card, ctl)) < 0)
> return err;
> - }
> return 0;
> }
Yep, both fixes for sb_mixer.c and ad1848_lib.c are correct.
I also wanted to start fixing them since Andrew reported a similar bug
in core/control.c, but you are much faster :) Thanks!
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Takashi
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2006-03-06 13:52 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-03-06 8:58 ad1848 double free Dave Jones
2006-03-06 13:52 ` Takashi Iwai
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox