* [PATCH] ALSA: usb-audio: Fix a memory leak bug
@ 2019-04-27 6:06 ` Wenwen Wang
0 siblings, 0 replies; 7+ messages in thread
From: Wenwen Wang @ 2019-04-27 6:06 UTC (permalink / raw)
To: Wenwen Wang
Cc: Jaroslav Kysela, Takashi Iwai, Jorge Sanjuan, Ruslan Bilovol,
moderated list:SOUND, open list
In parse_audio_selector_unit(), the string array 'namelist' is allocated
through kmalloc_array(), and each string pointer in this array, i.e.,
'namelist[]', is allocated through kmalloc() in the following for loop.
Then, a control instance 'kctl' is created by invoking snd_ctl_new1(). If
an error occurs during the creation process, the string array 'namelist',
including all string pointers in the array 'namelist[]', should be freed,
before the error code ENOMEM is returned. However, the current code does
not free 'namelist[]', resulting in memory leaks.
To fix the above issue, free all string pointers 'namelist[]' in a loop.
Signed-off-by: Wenwen Wang <wang6495@umn.edu>
---
sound/usb/mixer.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 73d7dff..53dccbf 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2675,6 +2675,8 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid,
kctl = snd_ctl_new1(&mixer_selectunit_ctl, cval);
if (! kctl) {
usb_audio_err(state->chip, "cannot malloc kcontrol\n");
+ for (i = 0; i < desc->bNrInPins; i++)
+ kfree(namelist[i]);
kfree(namelist);
kfree(cval);
return -ENOMEM;
--
2.7.4
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH] ALSA: usb-audio: Fix a memory leak bug
@ 2019-04-27 6:06 ` Wenwen Wang
0 siblings, 0 replies; 7+ messages in thread
From: Wenwen Wang @ 2019-04-27 6:06 UTC (permalink / raw)
To: Wenwen Wang
Cc: Jaroslav Kysela, Takashi Iwai, Jorge Sanjuan, Ruslan Bilovol,
moderated list:SOUND, open list
In parse_audio_selector_unit(), the string array 'namelist' is allocated
through kmalloc_array(), and each string pointer in this array, i.e.,
'namelist[]', is allocated through kmalloc() in the following for loop.
Then, a control instance 'kctl' is created by invoking snd_ctl_new1(). If
an error occurs during the creation process, the string array 'namelist',
including all string pointers in the array 'namelist[]', should be freed,
before the error code ENOMEM is returned. However, the current code does
not free 'namelist[]', resulting in memory leaks.
To fix the above issue, free all string pointers 'namelist[]' in a loop.
Signed-off-by: Wenwen Wang <wang6495@umn.edu>
---
sound/usb/mixer.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 73d7dff..53dccbf 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2675,6 +2675,8 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid,
kctl = snd_ctl_new1(&mixer_selectunit_ctl, cval);
if (! kctl) {
usb_audio_err(state->chip, "cannot malloc kcontrol\n");
+ for (i = 0; i < desc->bNrInPins; i++)
+ kfree(namelist[i]);
kfree(namelist);
kfree(cval);
return -ENOMEM;
--
2.7.4
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH] ALSA: usb-audio: Fix a memory leak bug
2019-04-27 6:06 ` Wenwen Wang
(?)
@ 2019-04-28 7:12 ` Takashi Iwai
-1 siblings, 0 replies; 7+ messages in thread
From: Takashi Iwai @ 2019-04-28 7:12 UTC (permalink / raw)
To: Wenwen Wang
Cc: moderated list:SOUND, Jorge Sanjuan, Ruslan Bilovol,
Jaroslav Kysela, open list
On Sat, 27 Apr 2019 08:06:46 +0200,
Wenwen Wang wrote:
>
> In parse_audio_selector_unit(), the string array 'namelist' is allocated
> through kmalloc_array(), and each string pointer in this array, i.e.,
> 'namelist[]', is allocated through kmalloc() in the following for loop.
> Then, a control instance 'kctl' is created by invoking snd_ctl_new1(). If
> an error occurs during the creation process, the string array 'namelist',
> including all string pointers in the array 'namelist[]', should be freed,
> before the error code ENOMEM is returned. However, the current code does
> not free 'namelist[]', resulting in memory leaks.
>
> To fix the above issue, free all string pointers 'namelist[]' in a loop.
>
> Signed-off-by: Wenwen Wang <wang6495@umn.edu>
Applied now, thanks.
Takashi
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] ALSA: usb-audio: fix a memory leak bug
2019-08-06 7:00 Wenwen Wang
@ 2019-08-06 10:47 ` Takashi Iwai
0 siblings, 0 replies; 7+ messages in thread
From: Takashi Iwai @ 2019-08-06 10:47 UTC (permalink / raw)
To: Wenwen Wang
Cc: moderated list:SOUND, Shuah Khan, Thomas Gleixner,
Jaroslav Kysela, Richard Fontana, Takashi Iwai, open list,
Hans Verkuil
On Tue, 06 Aug 2019 09:00:27 +0200,
Wenwen Wang wrote:
>
> In snd_usb_get_audioformat_uac3(), a structure for channel maps 'chmap' is
> allocated through kzalloc() before the execution goto 'found_clock'.
> However, this structure is not deallocated if the memory allocation for
> 'pd' fails, leading to a memory leak bug.
>
> To fix the above issue, free 'fp->chmap' before returning NULL.
>
> Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
Applied, thanks.
Takashi
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH] ALSA: usb-audio: fix a memory leak bug
@ 2019-08-06 7:00 Wenwen Wang
2019-08-06 10:47 ` Takashi Iwai
0 siblings, 1 reply; 7+ messages in thread
From: Wenwen Wang @ 2019-08-06 7:00 UTC (permalink / raw)
To: Wenwen Wang
Cc: Jaroslav Kysela, Takashi Iwai, Shuah Khan, Richard Fontana,
Hans Verkuil, Thomas Gleixner, moderated list:SOUND, open list
In snd_usb_get_audioformat_uac3(), a structure for channel maps 'chmap' is
allocated through kzalloc() before the execution goto 'found_clock'.
However, this structure is not deallocated if the memory allocation for
'pd' fails, leading to a memory leak bug.
To fix the above issue, free 'fp->chmap' before returning NULL.
Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
---
sound/usb/stream.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/usb/stream.c b/sound/usb/stream.c
index 7ee9d17..e852c7f 100644
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -1043,6 +1043,7 @@ snd_usb_get_audioformat_uac3(struct snd_usb_audio *chip,
pd = kzalloc(sizeof(*pd), GFP_KERNEL);
if (!pd) {
+ kfree(fp->chmap);
kfree(fp->rate_table);
kfree(fp);
return NULL;
--
2.7.4
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH] ALSA: usb-audio: fix a memory leak bug
2019-08-06 6:13 [PATCH] ALSA: usb-audio: fix " Wenwen Wang
@ 2019-08-06 6:40 ` Takashi Iwai
0 siblings, 0 replies; 7+ messages in thread
From: Takashi Iwai @ 2019-08-06 6:40 UTC (permalink / raw)
To: Wenwen Wang
Cc: moderated list:SOUND, Thomas Gleixner, Greg Kroah-Hartman,
Kate Stewart, Allison Randal, Jaroslav Kysela, Richard Fontana,
Takashi Iwai, open list
On Tue, 06 Aug 2019 08:13:06 +0200,
Wenwen Wang wrote:
>
> In add_new_ctl(), a mixer element structure is allocated through kzalloc()
> and the pointer is saved to 'elem'. Later on, a new alsa control element is
> created and added to this structure. In case the add process fails, i.e.,
> the return value of snd_usb_mixer_add_control() is less than 0, the
> allocated structure is not freed, leading to a memory leak.
>
> To fix the above issue, free 'elem' before returning the error.
>
> Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
It's a false-positive. snd_ctl_add() behaves differently from others,
it releases the given kctl at the error. And in this case, elem
already gets freed by kctl->private_free callback.
thanks,
Takashi
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH] ALSA: usb-audio: fix a memory leak bug
@ 2019-08-06 6:13 Wenwen Wang
2019-08-06 6:40 ` Takashi Iwai
0 siblings, 1 reply; 7+ messages in thread
From: Wenwen Wang @ 2019-08-06 6:13 UTC (permalink / raw)
To: Wenwen Wang
Cc: Jaroslav Kysela, Takashi Iwai, Kate Stewart, Greg Kroah-Hartman,
Richard Fontana, Allison Randal, Thomas Gleixner,
moderated list:SOUND, open list
In add_new_ctl(), a mixer element structure is allocated through kzalloc()
and the pointer is saved to 'elem'. Later on, a new alsa control element is
created and added to this structure. In case the add process fails, i.e.,
the return value of snd_usb_mixer_add_control() is less than 0, the
allocated structure is not freed, leading to a memory leak.
To fix the above issue, free 'elem' before returning the error.
Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
---
sound/usb/mixer_scarlett.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/sound/usb/mixer_scarlett.c b/sound/usb/mixer_scarlett.c
index 83715fd..a6c028a 100644
--- a/sound/usb/mixer_scarlett.c
+++ b/sound/usb/mixer_scarlett.c
@@ -562,8 +562,10 @@ static int add_new_ctl(struct usb_mixer_interface *mixer,
strlcpy(kctl->id.name, name, sizeof(kctl->id.name));
err = snd_usb_mixer_add_control(&elem->head, kctl);
- if (err < 0)
+ if (err < 0) {
+ kfree(elem);
return err;
+ }
if (elem_ret)
*elem_ret = elem;
--
2.7.4
^ permalink raw reply related [flat|nested] 7+ messages in thread
end of thread, other threads:[~2019-08-06 10:47 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-04-27 6:06 [PATCH] ALSA: usb-audio: Fix a memory leak bug Wenwen Wang
2019-04-27 6:06 ` Wenwen Wang
2019-04-28 7:12 ` Takashi Iwai
2019-08-06 6:13 [PATCH] ALSA: usb-audio: fix " Wenwen Wang
2019-08-06 6:40 ` Takashi Iwai
2019-08-06 7:00 Wenwen Wang
2019-08-06 10:47 ` Takashi Iwai
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.