Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965294AbcCIXwd (ORCPT ); Wed, 9 Mar 2016 18:52:33 -0500 Received: from youngberry.canonical.com ([91.189.89.112]:40543 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934460AbcCIXPT (ORCPT ); Wed, 9 Mar 2016 18:15:19 -0500 From: Kamal Mostafa To: linux-kernel@vger.kernel.org, stable@vger.kernel.org, kernel-team@lists.ubuntu.com Cc: Andrey Konovalov , Takashi Iwai , Kamal Mostafa Subject: [PATCH 3.13.y-ckt 005/138] ALSA: usb-audio: avoid freeing umidi object twice Date: Wed, 9 Mar 2016 15:12:12 -0800 Message-Id: <1457565265-15195-6-git-send-email-kamal@canonical.com> X-Mailer: git-send-email 2.7.0 In-Reply-To: <1457565265-15195-1-git-send-email-kamal@canonical.com> References: <1457565265-15195-1-git-send-email-kamal@canonical.com> X-Extended-Stable: 3.13 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1086 Lines: 36 3.13.11-ckt36 -stable review patch. If anyone has any objections, please let me know. ---8<------------------------------------------------------------ From: Andrey Konovalov commit 07d86ca93db7e5cdf4743564d98292042ec21af7 upstream. The 'umidi' object will be free'd on the error path by snd_usbmidi_free() when tearing down the rawmidi interface. So we shouldn't try to free it in snd_usbmidi_create() after having registered the rawmidi interface. Found by KASAN. Signed-off-by: Andrey Konovalov Acked-by: Clemens Ladisch Signed-off-by: Takashi Iwai Signed-off-by: Kamal Mostafa --- sound/usb/midi.c | 1 - 1 file changed, 1 deletion(-) diff --git a/sound/usb/midi.c b/sound/usb/midi.c index 9123fc5..424c1e8 100644 --- a/sound/usb/midi.c +++ b/sound/usb/midi.c @@ -2365,7 +2365,6 @@ int snd_usbmidi_create(struct snd_card *card, else err = snd_usbmidi_create_endpoints(umidi, endpoints); if (err < 0) { - snd_usbmidi_free(umidi); return err; } -- 2.7.0