if (tu->queue) { kfree(tu->queue); tu->queue = NULL; } if (tu->tqueue) { kfree(tu->tqueue); tu->tqueue = NULL; } 
kfree(tu->queue); tu->queue = NULL; kfree(tu->tqueue); tu->tqueue = NULL; 
static int snd_timer_user_tselect(struct file *file, snd_timer_select_t __user *_tselect){	snd_timer_user_t *tu;	snd_timer_select_t tselect;	char str[32];	int err = 0;		tu = file->private_data;	down(&tu->tread_sem);	if (tu->timeri) {		snd_timer_close(tu->timeri);		tu->timeri = NULL;	}	if (copy_from_user(&tselect, _tselect, sizeof(tselect))) {		err = -EFAULT;		goto __err;	}	sprintf(str, "application %i", current->pid);	if (tselect.id.dev_class != SNDRV_TIMER_CLASS_SLAVE)		tselect.id.dev_sclass = SNDRV_TIMER_SCLASS_APPLICATION;	if ((err = snd_timer_open(&tu->timeri, str, &tselect.id, current->pid)) < 0)		goto __err;	if (tu->queue) {		kfree(tu->queue);		tu->queue = NULL;	}	if (tu->tqueue) {		kfree(tu->tqueue);		tu->tqueue = NULL;	}	if (tu->tread) {		tu->tqueue = (snd_timer_tread_t *)kmalloc(tu->queue_size * sizeof(snd_timer_tread_t), GFP_KERNEL);		if (tu->tqueue == NULL)			err = -ENOMEM;	} else {		tu->queue = (snd_timer_read_t *)kmalloc(tu->queue_size * sizeof(snd_timer_read_t), GFP_KERNEL);		if (tu->queue == NULL)			err = -ENOMEM;	}	      	if (err < 0) {		snd_timer_close(tu->timeri);      		tu->timeri = NULL;      	} else {		tu->timeri->flags |= SNDRV_TIMER_IFLG_FAST;		tu->timeri->callback = tu->tread ? snd_timer_user_tinterrupt : snd_timer_user_interrupt;		tu->timeri->ccallback = snd_timer_user_ccallback;		tu->timeri->callback_data = (void *)tu;	}      __err:      	up(&tu->tread_sem);	return err;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/4d572776d4dfa2d5385a2ec3acec3cc059149e13/timer.c/buggy/sound/core/timer.c