From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751153AbcBMIIl (ORCPT ); Sat, 13 Feb 2016 03:08:41 -0500 Received: from mail-lb0-f174.google.com ([209.85.217.174]:32931 "EHLO mail-lb0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750887AbcBMIIk (ORCPT ); Sat, 13 Feb 2016 03:08:40 -0500 From: Andrey Konovalov To: Clemens Ladisch , Jaroslav Kysela , Takashi Iwai , alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org Cc: dvyukov@google.com, kcc@google.com, glider@google.com, Andrey Konovalov Subject: [PATCH] midi: avoid freeing umidi object twice Date: Sat, 13 Feb 2016 11:08:06 +0300 Message-Id: <1455350886-21126-1-git-send-email-andreyknvl@gmail.com> X-Mailer: git-send-email 1.9.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The 'umidi' object will be free'd on the error path by snd_usbmidi_free() when tearing down the rawmidi interface. So we shouldn't try to free it in snd_usbmidi_create() after having registered the rawmidi interface. Found by KASAN. Acked-by: Clemens Ladisch Signed-off-by: Andrey Konovalov --- sound/usb/midi.c | 1 - 1 file changed, 1 deletion(-) diff --git a/sound/usb/midi.c b/sound/usb/midi.c index cc39f63..007cf58 100644 --- a/sound/usb/midi.c +++ b/sound/usb/midi.c @@ -2455,7 +2455,6 @@ int snd_usbmidi_create(struct snd_card *card, else err = snd_usbmidi_create_endpoints(umidi, endpoints); if (err < 0) { - snd_usbmidi_free(umidi); return err; } -- 1.9.1