diff options
author | Julia Lawall <Julia.Lawall@lip6.fr> | 2012-10-21 12:52:03 +0200 |
---|---|---|
committer | Takashi Iwai <tiwai@suse.de> | 2012-10-21 14:17:43 +0200 |
commit | edb66893860dbc0631afc2807efdb209a03d57a2 (patch) | |
tree | 684ab05f2416b25119cac91fdfcc91363ef18d2c /sound | |
parent | ALSA: hda - Fix silent headphone output from Toshiba P200 (diff) | |
download | linux-edb66893860dbc0631afc2807efdb209a03d57a2.tar.xz linux-edb66893860dbc0631afc2807efdb209a03d57a2.zip |
ALSA: sound/isa/opti9xx/miro.c: eliminate possible double free
snd_miro_probe is a static function that is only called twice in the file
that defines it. At each call site, its argument is freed using
snd_card_free. Thus, there is no need for snd_miro_probe to call
snd_card_free on its argument on any of its error exit paths.
Because snd_card_free both reads the fields of its argument and kfrees its
argments, the results of the second snd_card_free should be unpredictable.
A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@r@
identifier f,free,a;
parameter list[n] ps;
type T;
expression e;
@@
f(ps,T a,...) {
... when any
when != a = e
if(...) { ... free(a); ... return ...; }
... when any
}
@@
identifier r.f,r.free;
expression x,a;
expression list[r.n] xs;
@@
* x = f(xs,a,...);
if (...) { ... free(a); ... return ...; }
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound')
-rw-r--r-- | sound/isa/opti9xx/miro.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/sound/isa/opti9xx/miro.c b/sound/isa/opti9xx/miro.c index 3d1afb612b35..4a7ff4e8985b 100644 --- a/sound/isa/opti9xx/miro.c +++ b/sound/isa/opti9xx/miro.c @@ -1286,7 +1286,6 @@ static int __devinit snd_miro_probe(struct snd_card *card) error = snd_card_miro_aci_detect(card, miro); if (error < 0) { - snd_card_free(card); snd_printk(KERN_ERR "unable to detect aci chip\n"); return -ENODEV; } |