From patchwork Wed Mar 5 11:07:15 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 3773371 X-Patchwork-Delegate: tiwai@suse.de Return-Path: X-Original-To: patchwork-alsa-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 295B2BF13A for ; Wed, 5 Mar 2014 11:33:10 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 575A220251 for ; Wed, 5 Mar 2014 11:33:09 +0000 (UTC) Received: from alsa0.perex.cz (alsa0.perex.cz [77.48.224.243]) by mail.kernel.org (Postfix) with ESMTP id 1BCD620222 for ; Wed, 5 Mar 2014 11:33:08 +0000 (UTC) Received: by alsa0.perex.cz (Postfix, from userid 1000) id 0CD2E265AA7; Wed, 5 Mar 2014 12:33:07 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,NO_DNS_FOR_FROM, UNPARSEABLE_RELAY autolearn=no version=3.3.1 Received: from alsa0.perex.cz (localhost [IPv6:::1]) by alsa0.perex.cz (Postfix) with ESMTP id B19442658E9; Wed, 5 Mar 2014 12:21:45 +0100 (CET) X-Original-To: alsa-devel@alsa-project.org Delivered-To: alsa-devel@alsa-project.org Received: by alsa0.perex.cz (Postfix, from userid 1000) id 22FA12658EA; Wed, 5 Mar 2014 12:21:44 +0100 (CET) Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) by alsa0.perex.cz (Postfix) with ESMTP id 24B63265D48 for ; Wed, 5 Mar 2014 12:07:48 +0100 (CET) Received: from acsinet21.oracle.com (acsinet21.oracle.com [141.146.126.237]) by aserp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id s25B7k6M017139 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 5 Mar 2014 11:07:47 GMT Received: from aserz7022.oracle.com (aserz7022.oracle.com [141.146.126.231]) by acsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s25B7iUq004210 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 5 Mar 2014 11:07:44 GMT Received: from abhmp0001.oracle.com (abhmp0001.oracle.com [141.146.116.7]) by aserz7022.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id s25B7ite013762; Wed, 5 Mar 2014 11:07:44 GMT Received: from elgon.mountain (/41.202.233.181) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 05 Mar 2014 03:07:43 -0800 Date: Wed, 5 Mar 2014 14:07:15 +0300 From: Dan Carpenter To: Jaroslav Kysela Message-ID: <20140305110715.GB16926@elgon.mountain> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) X-Source-IP: acsinet21.oracle.com [141.146.126.237] Cc: Takashi Iwai , alsa-devel@alsa-project.org, kernel-janitors@vger.kernel.org Subject: [alsa-devel] [patch] ALSA: echoaudio: use after free on error X-BeenThere: alsa-devel@alsa-project.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Alsa-devel mailing list for ALSA developers - http://www.alsa-project.org" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: alsa-devel-bounces@alsa-project.org Sender: alsa-devel-bounces@alsa-project.org X-Virus-Scanned: ClamAV using ClamSMTP There are some places where we dereference "chip" in the error message but we've already freed it. Signed-off-by: Dan Carpenter diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c index 166ec0c120d4..9f10c9e0df5e 100644 --- a/sound/pci/echoaudio/echoaudio.c +++ b/sound/pci/echoaudio/echoaudio.c @@ -1990,8 +1990,8 @@ static int snd_echo_create(struct snd_card *card, if ((chip->iores = request_mem_region(chip->dsp_registers_phys, sz, ECHOCARD_NAME)) == NULL) { - snd_echo_free(chip); dev_err(chip->card->dev, "cannot get memory region\n"); + snd_echo_free(chip); return -EBUSY; } chip->dsp_registers = (volatile u32 __iomem *) @@ -1999,8 +1999,8 @@ static int snd_echo_create(struct snd_card *card, if (request_irq(pci->irq, snd_echo_interrupt, IRQF_SHARED, KBUILD_MODNAME, chip)) { - snd_echo_free(chip); dev_err(chip->card->dev, "cannot grab irq\n"); + snd_echo_free(chip); return -EBUSY; } chip->irq = pci->irq; @@ -2012,8 +2012,8 @@ static int snd_echo_create(struct snd_card *card, if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(chip->pci), sizeof(struct comm_page), &chip->commpage_dma_buf) < 0) { - snd_echo_free(chip); dev_err(chip->card->dev, "cannot allocate the comm page\n"); + snd_echo_free(chip); return -ENOMEM; } chip->comm_page_phys = chip->commpage_dma_buf.addr; @@ -2291,8 +2291,8 @@ static int snd_echo_resume(struct device *dev) if (request_irq(pci->irq, snd_echo_interrupt, IRQF_SHARED, KBUILD_MODNAME, chip)) { - snd_echo_free(chip); dev_err(chip->card->dev, "cannot grab irq\n"); + snd_echo_free(chip); return -EBUSY; } chip->irq = pci->irq;