On Sun, 11 Aug 2024 22:23:36 +0200,
Ivan Orlov wrote:
> +static int snd_utimer_ioctl_create(struct file *file,
> + struct snd_timer_uinfo __user *_utimer_info)
> +{
> + struct snd_utimer *utimer;
> + struct snd_timer_uinfo *utimer_info __free(kfree) = NULL;
> + int err;
> +
> + utimer_info = memdup_user(_utimer_info, sizeof(*utimer_info));
> + if (IS_ERR(utimer_info))
> + return PTR_ERR(no_free_ptr(utimer_info));
> +
> + err = snd_utimer_create(utimer_info, &utimer);
> + if (err < 0)
> + return err;
> +
> + utimer_info->id = utimer->id;
> +
> + err = copy_to_user(_utimer_info, utimer_info, sizeof(*utimer_info));
> + if (err) {
> + snd_utimer_free(utimer);
> + return -EFAULT;
> + }
> +
> + return anon_inode_getfd(utimer->name, &snd_utimer_fops, utimer, O_RDWR | O_CLOEXEC);
Wouldn't utimer be left unfreed if this returns an error?
thanks,
Takashi
