Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
  ALSA: rawmidi: fix the get next midi device ioctl
  ALSA: hda - Fix wrong HP pin detection in snd_hda_parse_pin_def_config()
  ALSA: seq/oss - Fix double-free at error path of snd_seq_oss_open()
  ALSA: msnd-classic: Fix invalid cfg parameter
  ALSA: hda - Enable PC-beep for EeePC with ALC269 codec
  ALSA: hda - Add errata initverb sequence for CS42xx codecs
  ALSA: usb - Release capture substream URBs properly
  ALSA: virtuoso: fix setting of Xonar DS line-in/mic-in controls
  ALSA: virtuoso: work around missing reset in the Xonar DS Windows driver
  ALSA: hda - Add quirk for Lenovo T400s
  ALSA: usb-audio: fix detection of vendor-specific device protocol settings
  ALSA: usb-audio: Assume first control interface is for audio
  ALSA: hda - Add a new hp-laptop model for Conexant 5066, tested on HP G60

2 files changed, 6 insertions, 5 deletions

diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index eb68326c37d4..a7868ad4d530 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -829,6 +829,8 @@ static int snd_rawmidi_control_ioctl(struct snd_card *card,
                 
                 if (get_user(device, (int __user *)argp))
                         return -EFAULT;
+                if (device >= SNDRV_RAWMIDI_DEVICES) /* next device is -1 */
+                        device = SNDRV_RAWMIDI_DEVICES - 1;
                 mutex_lock(&register_mutex);
                 device = device < 0 ? 0 : device + 1;
                 while (device < SNDRV_RAWMIDI_DEVICES) {
diff --git a/sound/core/seq/oss/seq_oss_init.c b/sound/core/seq/oss/seq_oss_init.c
index 685712276ac9..69cd7b3c362d 100644
--- a/sound/core/seq/oss/seq_oss_init.c
+++ b/sound/core/seq/oss/seq_oss_init.c
@@ -281,13 +281,10 @@ snd_seq_oss_open(struct file *file, int level)
         return 0;
 
  _error:
-        snd_seq_oss_writeq_delete(dp->writeq);
-        snd_seq_oss_readq_delete(dp->readq);
         snd_seq_oss_synth_cleanup(dp);
         snd_seq_oss_midi_cleanup(dp);
-        delete_port(dp);
         delete_seq_queue(dp->queue);
-        kfree(dp);
+        delete_port(dp);
 
         return rc;
 }
@@ -350,8 +347,10 @@ create_port(struct seq_oss_devinfo *dp)
 static int
 delete_port(struct seq_oss_devinfo *dp)
 {
-        if (dp->port < 0)
+        if (dp->port < 0) {
+                kfree(dp);
                 return 0;
+        }
 
         debug_printk(("delete_port %i\n", dp->port));
         return snd_seq_event_port_detach(dp->cseq, dp->port);