Bug#641946: fm801: Fix double free in case of error in tuner detection
 

Commit 9676001559fce06e37c7dc230ab275f605556176
("ALSA: fm801: add error handling if auto-detect fails") added
incorrect error handling.

Once we have successfully called snd_device_new(), the cleanup
function fm801_free() will automatically be called by snd_card_free()
and we must *not* also call fm801_free() directly.

Reported-by: Hor Jiun Shyong <jiunshyong@gmail.com>
References: http://bugs.debian.org/641946
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: stable@kernel.org [v3.0+]
---
sound/pci/fm801.c | 2 --
1 files changed, 0 insertions(+), 2 deletions(-)

diff --git a/sound/pci/fm801.c b/sound/pci/fm801.c
index a7ec703..0dd8963 100644
--- a/sound/pci/fm801.c
+++ b/sound/pci/fm801.c
@@ -1236,7 +1236,6 @@ static int __devinit snd_fm801_create(struct snd_card *card,
(tea575x_tuner & TUNER_TYPE_MASK) < 4) {
if (snd_tea575x_init(&chip->tea)) {
snd_printk(KERN_ERR "TEA575x radio not found
");
- snd_fm801_free(chip);
return -ENODEV;
}
} else if ((tea575x_tuner & TUNER_TYPE_MASK) == 0) {
@@ -1251,7 +1250,6 @@ static int __devinit snd_fm801_create(struct snd_card *card,
}
if (tea575x_tuner == 4) {
snd_printk(KERN_ERR "TEA575x radio not found
");
- snd_fm801_free(chip);
return -ENODEV;
}
}
--
1.7.5.4






--
To UNSUBSCRIBE, email to debian-kernel-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: 1316698738.4122.30.camel@deadeye">http://lists.debian.org/1316698738.4122.30.camel@deadeye

Bug#641946: fm801: Fix double free in case of error in tuner detection
 

At Thu, 22 Sep 2011 14:38:58 +0100,
Ben Hutchings wrote:
>
> Commit 9676001559fce06e37c7dc230ab275f605556176
> ("ALSA: fm801: add error handling if auto-detect fails") added
> incorrect error handling.
>
> Once we have successfully called snd_device_new(), the cleanup
> function fm801_free() will automatically be called by snd_card_free()
> and we must *not* also call fm801_free() directly.
>
> Reported-by: Hor Jiun Shyong <jiunshyong@gmail.com>
> References: http://bugs.debian.org/641946
> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
> Cc: stable@kernel.org [v3.0+]

Thanks, applied both patches now.


Takashi

> ---
> sound/pci/fm801.c | 2 --
> 1 files changed, 0 insertions(+), 2 deletions(-)
>
> diff --git a/sound/pci/fm801.c b/sound/pci/fm801.c
> index a7ec703..0dd8963 100644
> --- a/sound/pci/fm801.c
> +++ b/sound/pci/fm801.c
> @@ -1236,7 +1236,6 @@ static int __devinit snd_fm801_create(struct snd_card *card,
> (tea575x_tuner & TUNER_TYPE_MASK) < 4) {
> if (snd_tea575x_init(&chip->tea)) {
> snd_printk(KERN_ERR "TEA575x radio not found
");
> - snd_fm801_free(chip);
> return -ENODEV;
> }
> } else if ((tea575x_tuner & TUNER_TYPE_MASK) == 0) {
> @@ -1251,7 +1250,6 @@ static int __devinit snd_fm801_create(struct snd_card *card,
> }
> if (tea575x_tuner == 4) {
> snd_printk(KERN_ERR "TEA575x radio not found
");
> - snd_fm801_free(chip);
> return -ENODEV;
> }
> }
> --
> 1.7.5.4
>
>
>



--
To UNSUBSCRIBE, email to debian-kernel-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: s5hr538vdvb.wl%tiwai@suse.de">http://lists.debian.org/s5hr538vdvb.wl%tiwai@suse.de