2006-03-06 08:58:44

by Dave Jones

Subject: ad1848 double free

Same again, snd_ctl_add() already kfree's on error.

Coverity #956
Signed-off-by: Dave Jones <[email protected]>

--- linux-2.6/sound/isa/ad1848/ad1848_lib.c~ 2006-03-06 03:57:22.000000000 -0500
+++ linux-2.6/sound/isa/ad1848/ad1848_lib.c 2006-03-06 03:57:30.000000000 -0500
@@ -1202,10 +1202,8 @@ int snd_ad1848_add_ctl(struct snd_ad1848
strlcpy(ctl->id.name, name, sizeof(ctl->id.name));
ctl->id.index = index;
ctl->private_value = value;
- if ((err = snd_ctl_add(chip->card, ctl)) < 0) {
- snd_ctl_free_one(ctl);
+ if ((err = snd_ctl_add(chip->card, ctl)) < 0)
return err;
- }
return 0;
}


--
http://www.codemonkey.org.uk

2006-03-06 13:52:13

by Takashi Iwai

Subject: Re: ad1848 double free

At Mon, 6 Mar 2006 03:58:18 -0500,
Dave Jones wrote:
>
> Same again, snd_ctl_add() already kfree's on error.
>
> Coverity #956
> Signed-off-by: Dave Jones <[email protected]>
>
> --- linux-2.6/sound/isa/ad1848/ad1848_lib.c~ 2006-03-06 03:57:22.000000000 -0500
> +++ linux-2.6/sound/isa/ad1848/ad1848_lib.c 2006-03-06 03:57:30.000000000 -0500
> @@ -1202,10 +1202,8 @@ int snd_ad1848_add_ctl(struct snd_ad1848
> strlcpy(ctl->id.name, name, sizeof(ctl->id.name));
> ctl->id.index = index;
> ctl->private_value = value;
> - if ((err = snd_ctl_add(chip->card, ctl)) < 0) {
> - snd_ctl_free_one(ctl);
> + if ((err = snd_ctl_add(chip->card, ctl)) < 0)
> return err;
> - }
> return 0;
> }

Yep, both fixes for sb_mixer.c and ad1848_lib.c are correct.
I also wanted to start fixing them since Andrew reported a similar bug
in core/control.c, but you are much faster :) Thanks!


Signed-off-by: Takashi Iwai <[email protected]>


Takashi