diff options
author | Ben Hutchings <ben@decadent.org.uk> | 2011-09-22 09:38:58 -0400 |
---|---|---|
committer | Takashi Iwai <tiwai@suse.de> | 2011-09-22 09:51:46 -0400 |
commit | 2ba34e43ba0469086d1ff81c13a9aa9070c1a0e1 (patch) | |
tree | 3392535e3ee4970c4dac01784b07c9e0cfe5cf5d /sound/pci | |
parent | 46724c2e023cb7ba5cd5000dee6481f0a15ebed9 (diff) |
ALSA: fm801: Fix double free in case of error in tuner detection
Commit 9676001559fce06e37c7dc230ab275f605556176
("ALSA: fm801: add error handling if auto-detect fails") added
incorrect error handling.
Once we have successfully called snd_device_new(), the cleanup
function fm801_free() will automatically be called by snd_card_free()
and we must *not* also call fm801_free() directly.
Reported-by: Hor Jiun Shyong <jiunshyong@gmail.com>
References: http://bugs.debian.org/641946
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: stable@kernel.org [v3.0+]
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/pci')
-rw-r--r-- | sound/pci/fm801.c | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/sound/pci/fm801.c b/sound/pci/fm801.c index f9123f09e83e..a96456daf393 100644 --- a/sound/pci/fm801.c +++ b/sound/pci/fm801.c | |||
@@ -1236,7 +1236,6 @@ static int __devinit snd_fm801_create(struct snd_card *card, | |||
1236 | (tea575x_tuner & TUNER_TYPE_MASK) < 4) { | 1236 | (tea575x_tuner & TUNER_TYPE_MASK) < 4) { |
1237 | if (snd_tea575x_init(&chip->tea)) { | 1237 | if (snd_tea575x_init(&chip->tea)) { |
1238 | snd_printk(KERN_ERR "TEA575x radio not found\n"); | 1238 | snd_printk(KERN_ERR "TEA575x radio not found\n"); |
1239 | snd_fm801_free(chip); | ||
1240 | return -ENODEV; | 1239 | return -ENODEV; |
1241 | } | 1240 | } |
1242 | } else if ((tea575x_tuner & TUNER_TYPE_MASK) == 0) { | 1241 | } else if ((tea575x_tuner & TUNER_TYPE_MASK) == 0) { |
@@ -1251,7 +1250,6 @@ static int __devinit snd_fm801_create(struct snd_card *card, | |||
1251 | } | 1250 | } |
1252 | if (tea575x_tuner == 4) { | 1251 | if (tea575x_tuner == 4) { |
1253 | snd_printk(KERN_ERR "TEA575x radio not found\n"); | 1252 | snd_printk(KERN_ERR "TEA575x radio not found\n"); |
1254 | snd_fm801_free(chip); | ||
1255 | return -ENODEV; | 1253 | return -ENODEV; |
1256 | } | 1254 | } |
1257 | } | 1255 | } |