summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJulia Lawall <Julia.Lawall@lip6.fr>2012-10-21 14:52:03 +0400
committerTakashi Iwai <tiwai@suse.de>2012-10-21 16:17:43 +0400
commitedb66893860dbc0631afc2807efdb209a03d57a2 (patch)
tree684ab05f2416b25119cac91fdfcc91363ef18d2c
parentcb766404e6b8c566569eb9ada02ea45d28729864 (diff)
downloadlinux-edb66893860dbc0631afc2807efdb209a03d57a2.tar.xz
ALSA: sound/isa/opti9xx/miro.c: eliminate possible double free
snd_miro_probe is a static function that is only called twice in the file that defines it. At each call site, its argument is freed using snd_card_free. Thus, there is no need for snd_miro_probe to call snd_card_free on its argument on any of its error exit paths. Because snd_card_free both reads the fields of its argument and kfrees its argments, the results of the second snd_card_free should be unpredictable. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // <smpl> @r@ identifier f,free,a; parameter list[n] ps; type T; expression e; @@ f(ps,T a,...) { ... when any when != a = e if(...) { ... free(a); ... return ...; } ... when any } @@ identifier r.f,r.free; expression x,a; expression list[r.n] xs; @@ * x = f(xs,a,...); if (...) { ... free(a); ... return ...; } // </smpl> Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: Takashi Iwai <tiwai@suse.de>
-rw-r--r--sound/isa/opti9xx/miro.c1
1 files changed, 0 insertions, 1 deletions
diff --git a/sound/isa/opti9xx/miro.c b/sound/isa/opti9xx/miro.c
index 3d1afb612b35..4a7ff4e8985b 100644
--- a/sound/isa/opti9xx/miro.c
+++ b/sound/isa/opti9xx/miro.c
@@ -1286,7 +1286,6 @@ static int __devinit snd_miro_probe(struct snd_card *card)
error = snd_card_miro_aci_detect(card, miro);
if (error < 0) {
- snd_card_free(card);
snd_printk(KERN_ERR "unable to detect aci chip\n");
return -ENODEV;
}