1 files changed, 5 insertions, 3 deletions

diff --git a/sound/usb/stream.c b/sound/usb/stream.c
index 51258a15f653..8e9548bc1f1a 100644
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -36,7 +36,6 @@
 #include "format.h"
 #include "clock.h"
 #include "stream.h"
-#include "media.h"
 
 /*
  * free a substream
@@ -53,7 +52,6 @@ static void free_substream(struct snd_usb_substream *subs)
                 kfree(fp);
         }
         kfree(subs->rate_list.list);
-        media_snd_stream_delete(subs);
 }
 
 
@@ -316,7 +314,9 @@ static struct snd_pcm_chmap_elem *convert_chmap(int channels, unsigned int bits,
 /*
  * add this endpoint to the chip instance.
  * if a stream with the same endpoint already exists, append to it.
- * if not, create a new pcm stream.
+ * if not, create a new pcm stream. note, fp is added to the substream
+ * fmt_list and will be freed on the chip instance release. do not free
+ * fp or do remove it from the substream fmt_list to avoid double-free.
  */
 int snd_usb_add_audio_stream(struct snd_usb_audio *chip,
                              int stream,
@@ -677,6 +677,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no)
                                         * (fp->maxpacksize & 0x7ff);
                 fp->attributes = parse_uac_endpoint_attributes(chip, alts, protocol, iface_no);
                 fp->clock = clock;
+                INIT_LIST_HEAD(&fp->list);
 
                 /* some quirks for attributes here */
 
@@ -725,6 +726,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no)
                 dev_dbg(&dev->dev, "%u:%d: add audio endpoint %#x\n", iface_no, altno, fp->endpoint);
                 err = snd_usb_add_audio_stream(chip, stream, fp);
                 if (err < 0) {
+                        list_del(&fp->list); /* unlink for avoiding double-free */
                         kfree(fp->rate_table);
                         kfree(fp->chmap);
                         kfree(fp);