[PATCH] [UBUNTU:sound/usb] Fix double kfree() and possible memory leak in sound/usb/usbmixer.c

[crimsun at fungus.sh.nu]

Subject: [PATCH] [UBUNTU:sound/usb] Fix double kfree() and possible memory leak in sound/usb/usbmixer.c

UpstreamStatus: Added in upstream sound/usb/usbmixer.c r1.5[45]

Coverity bug #959: snd_ctl_add() kfree()s the kcontrol upon failure, so
the driver is mistakenly doing a double kfree(). Patch from Dave Jones
<davej at redhat.com>.

Additionally, namelist can be leaked in parse_audio_selector_unit().
Patch from Jesper Juhl <jesper.juhl at gmail.com>.

Signed-off-by: Daniel T Chen <crimsun at ubuntu.com>

---

 sound/usb/usbmixer.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

977a2931e6690e65e42b4bd1adbb9b5ad432b378
diff --git a/sound/usb/usbmixer.c b/sound/usb/usbmixer.c
index e570d14..161efc1 100644
--- a/sound/usb/usbmixer.c
+++ b/sound/usb/usbmixer.c
@@ -439,7 +439,6 @@ static int add_control_to_empty(mixer_bu
 		kctl->id.index++;
 	if ((err = snd_ctl_add(state->chip->card, kctl)) < 0) {
 		snd_printd(KERN_ERR "cannot add control (err = %d)\n", err);
-		snd_ctl_free_one(kctl);
 		return err;
 	}
 	cval->elem_id = &kctl->id;
@@ -1474,6 +1473,7 @@ static int parse_audio_selector_unit(mix
 	kctl = snd_ctl_new1(&mixer_selectunit_ctl, cval);
 	if (! kctl) {
 		snd_printk(KERN_ERR "cannot malloc kcontrol\n");
+		kfree(namelist);
 		kfree(cval);
 		return -ENOMEM;
 	}
-- 
1.1.3


-- 
Daniel T. Chen            crimsun at ubuntu.com
GPG key:   www.sh.nu/~crimsun/pubkey.gpg.asc
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20060324/82a6a2d9/attachment.sig>