[PATCH] ALSA: usb-audio: fix a memory leak bug

[PATCH] ALSA: usb-audio: fix a memory leak bug

[Wenwen Wang]

In snd_usb_get_audioformat_uac3(), a structure for channel maps 'chmap' is
allocated through kzalloc() before the execution goto 'found_clock'.
However, this structure is not deallocated if the memory allocation for
'pd' fails, leading to a memory leak bug.

To fix the above issue, free 'fp->chmap' before returning NULL.

Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
---
 sound/usb/stream.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/usb/stream.c b/sound/usb/stream.c
index 7ee9d17..e852c7f 100644
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -1043,6 +1043,7 @@ snd_usb_get_audioformat_uac3(struct snd_usb_audio *chip,

                pd = kzalloc(sizeof(*pd), GFP_KERNEL);
                if (!pd) {
+                       kfree(fp->chmap);
                        kfree(fp->rate_table);
                        kfree(fp);
                        return NULL;
--
2.7.4

Re: [PATCH] ALSA: usb-audio: fix a memory leak bug

[Takashi Iwai]

On Tue, 06 Aug 2019 09:00:27 +0200,
Wenwen Wang wrote:
> 
> In snd_usb_get_audioformat_uac3(), a structure for channel maps 'chmap' is
> allocated through kzalloc() before the execution goto 'found_clock'.
> However, this structure is not deallocated if the memory allocation for
> 'pd' fails, leading to a memory leak bug.
> 
> To fix the above issue, free 'fp->chmap' before returning NULL.
> 
> Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>

Applied, thanks.


Takashi

[PATCH] ALSA: usb-audio: fix a memory leak bug

[Wenwen Wang]

In add_new_ctl(), a mixer element structure is allocated through kzalloc()
and the pointer is saved to 'elem'. Later on, a new alsa control element is
created and added to this structure. In case the add process fails, i.e.,
the return value of snd_usb_mixer_add_control() is less than 0, the
allocated structure is not freed, leading to a memory leak.

To fix the above issue, free 'elem' before returning the error.

Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
---
 sound/usb/mixer_scarlett.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/usb/mixer_scarlett.c b/sound/usb/mixer_scarlett.c
index 83715fd..a6c028a 100644
--- a/sound/usb/mixer_scarlett.c
+++ b/sound/usb/mixer_scarlett.c
@@ -562,8 +562,10 @@ static int add_new_ctl(struct usb_mixer_interface *mixer,
        strlcpy(kctl->id.name, name, sizeof(kctl->id.name));

        err = snd_usb_mixer_add_control(&elem->head, kctl);
-       if (err < 0)
+       if (err < 0) {
+               kfree(elem);
                return err;
+       }

        if (elem_ret)
                *elem_ret = elem;
--
2.7.4

Re: [PATCH] ALSA: usb-audio: fix a memory leak bug

[Takashi Iwai]

On Tue, 06 Aug 2019 08:13:06 +0200,
Wenwen Wang wrote:
> 
> In add_new_ctl(), a mixer element structure is allocated through kzalloc()
> and the pointer is saved to 'elem'. Later on, a new alsa control element is
> created and added to this structure. In case the add process fails, i.e.,
> the return value of snd_usb_mixer_add_control() is less than 0, the
> allocated structure is not freed, leading to a memory leak.
> 
> To fix the above issue, free 'elem' before returning the error.
> 
> Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>

It's a false-positive.  snd_ctl_add() behaves differently from others,
it releases the given kctl at the error.  And in this case, elem
already gets freed by kctl->private_free callback.


thanks,

Takashi

[PATCH] ALSA: usb-audio: Fix a memory leak bug

[Wenwen Wang]

In parse_audio_selector_unit(), the string array 'namelist' is allocated
through kmalloc_array(), and each string pointer in this array, i.e.,
'namelist[]', is allocated through kmalloc() in the following for loop.
Then, a control instance 'kctl' is created by invoking snd_ctl_new1(). If
an error occurs during the creation process, the string array 'namelist',
including all string pointers in the array 'namelist[]', should be freed,
before the error code ENOMEM is returned. However, the current code does
not free 'namelist[]', resulting in memory leaks.

To fix the above issue, free all string pointers 'namelist[]' in a loop.

Signed-off-by: Wenwen Wang <wang6495@umn.edu>
---
 sound/usb/mixer.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 73d7dff..53dccbf 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2675,6 +2675,8 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid,
 	kctl = snd_ctl_new1(&mixer_selectunit_ctl, cval);
 	if (! kctl) {
 		usb_audio_err(state->chip, "cannot malloc kcontrol\n");
+		for (i = 0; i < desc->bNrInPins; i++)
+			kfree(namelist[i]);
 		kfree(namelist);
 		kfree(cval);
 		return -ENOMEM;
-- 
2.7.4

[PATCH] ALSA: usb-audio: Fix a memory leak bug

[Wenwen Wang]

In parse_audio_selector_unit(), the string array 'namelist' is allocated
through kmalloc_array(), and each string pointer in this array, i.e.,
'namelist[]', is allocated through kmalloc() in the following for loop.
Then, a control instance 'kctl' is created by invoking snd_ctl_new1(). If
an error occurs during the creation process, the string array 'namelist',
including all string pointers in the array 'namelist[]', should be freed,
before the error code ENOMEM is returned. However, the current code does
not free 'namelist[]', resulting in memory leaks.

To fix the above issue, free all string pointers 'namelist[]' in a loop.

Signed-off-by: Wenwen Wang <wang6495@umn.edu>
---
 sound/usb/mixer.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 73d7dff..53dccbf 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2675,6 +2675,8 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid,
 	kctl = snd_ctl_new1(&mixer_selectunit_ctl, cval);
 	if (! kctl) {
 		usb_audio_err(state->chip, "cannot malloc kcontrol\n");
+		for (i = 0; i < desc->bNrInPins; i++)
+			kfree(namelist[i]);
 		kfree(namelist);
 		kfree(cval);
 		return -ENOMEM;
-- 
2.7.4

Re: [PATCH] ALSA: usb-audio: Fix a memory leak bug

[Takashi Iwai]

On Sat, 27 Apr 2019 08:06:46 +0200,
Wenwen Wang wrote:
> 
> In parse_audio_selector_unit(), the string array 'namelist' is allocated
> through kmalloc_array(), and each string pointer in this array, i.e.,
> 'namelist[]', is allocated through kmalloc() in the following for loop.
> Then, a control instance 'kctl' is created by invoking snd_ctl_new1(). If
> an error occurs during the creation process, the string array 'namelist',
> including all string pointers in the array 'namelist[]', should be freed,
> before the error code ENOMEM is returned. However, the current code does
> not free 'namelist[]', resulting in memory leaks.
> 
> To fix the above issue, free all string pointers 'namelist[]' in a loop.
> 
> Signed-off-by: Wenwen Wang <wang6495@umn.edu>

Applied now, thanks.


Takashi