1 files changed, 13 insertions, 9 deletions

diff --git a/sound/usb/usx2y/us122l.c b/sound/usb/usx2y/us122l.c
index 98276aafefe6..a5aae9d67f31 100644
--- a/sound/usb/usx2y/us122l.c
+++ b/sound/usb/usx2y/us122l.c
@@ -349,14 +349,10 @@ static int usb_stream_hwdep_ioctl(struct snd_hwdep *hw, struct file *file,
         if (cmd != SNDRV_USB_STREAM_IOCTL_SET_PARAMS)
                 return -ENOTTY;
 
-        cfg = kmalloc(sizeof(*cfg), GFP_KERNEL);
-        if (!cfg)
-                return -ENOMEM;
+        cfg = memdup_user((void *)arg, sizeof(*cfg));
+        if (IS_ERR(cfg))
+                return PTR_ERR(cfg);
 
-        if (copy_from_user(cfg, (void *)arg, sizeof(*cfg))) {
-                err = -EFAULT;
-                goto free;
-        }
         if (cfg->version != USB_STREAM_INTERFACE_VERSION) {
                 err = -ENXIO;
                 goto free;
@@ -478,6 +474,14 @@ static bool us122l_create_card(struct snd_card *card)
         return true;
 }
 
+static void snd_us122l_free(struct snd_card *card)
+{
+        struct us122l   *us122l = US122L(card);
+        int             index = us122l->chip.index;
+        if (index >= 0  &&  index < SNDRV_CARDS)
+                snd_us122l_card_used[index] = 0;
+}
+
 static int usx2y_create_card(struct usb_device *device, struct snd_card **cardp)
 {
         int             dev;
@@ -494,7 +498,7 @@ static int usx2y_create_card(struct usb_device *device, struct snd_card **cardp)
         if (err < 0)
                 return err;
         snd_us122l_card_used[US122L(card)->chip.index = dev] = 1;
-
+        card->private_free = snd_us122l_free;
         US122L(card)->chip.dev = device;
         US122L(card)->chip.card = card;
         mutex_init(&US122L(card)->mutex);
@@ -588,7 +592,7 @@ static void snd_us122l_disconnect(struct usb_interface *intf)
         }
 
         usb_put_intf(intf);
-        usb_put_dev(US122L(card)->chip.dev);
+        usb_put_dev(us122l->chip.dev);
 
         while (atomic_read(&us122l->mmap_count))
                 msleep(500);