[patch] ASoC: Baytrail: fix error handling in sst_byt_dsp_init()

[patch] ASoC: Baytrail: fix error handling in sst_byt_dsp_init()

[Dan Carpenter]

Calling "kfree(byt)" is a double free because that was allocated with
devm_kzalloc().  There were a couple places which leak "byt->msg".  That
memory is allocated in msg_empty_list_init().

Fixes: f7d01fd6754c ('ASoC: Intel: Add Intel Baytrail SST DSP IPC support')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/sound/soc/intel/sst-baytrail-ipc.c b/sound/soc/intel/sst-baytrail-ipc.c
index c12e194bbc6b..d0eaeee21be4 100644
--- a/sound/soc/intel/sst-baytrail-ipc.c
+++ b/sound/soc/intel/sst-baytrail-ipc.c
@@ -796,7 +796,7 @@ int sst_byt_dsp_init(struct device *dev, struct sst_pdata *pdata)
 
 	err = msg_empty_list_init(byt);
 	if (err < 0)
-		goto list_err;
+		return -ENOMEM;
 
 	/* start the IPC message thread */
 	init_kthread_worker(&byt->kworker);
@@ -806,7 +806,7 @@ int sst_byt_dsp_init(struct device *dev, struct sst_pdata *pdata)
 	if (IS_ERR(byt->tx_thread)) {
 		err = PTR_ERR(byt->tx_thread);
 		dev_err(byt->dev, "error failed to create message TX task\n");
-		goto list_err;
+		goto err_free_msg;
 	}
 	init_kthread_work(&byt->kwork, sst_byt_ipc_tx_msgs);
 
@@ -816,7 +816,7 @@ int sst_byt_dsp_init(struct device *dev, struct sst_pdata *pdata)
 	byt->dsp = sst_dsp_new(dev, &byt_dev, pdata);
 	if (byt->dsp == NULL) {
 		err = -ENODEV;
-		goto list_err;
+		goto err_free_msg;
 	}
 
 	/* keep the DSP in reset state for base FW loading */
@@ -848,9 +848,9 @@ boot_err:
 	sst_fw_free(byt_sst_fw);
 fw_err:
 	sst_dsp_free(byt->dsp);
+err_free_msg:
 	kfree(byt->msg);
-list_err:
-	kfree(byt);
+
 	return err;
 }
 EXPORT_SYMBOL_GPL(sst_byt_dsp_init);

Re: [alsa-devel] [patch] ASoC: Baytrail: fix error handling in sst_byt_dsp_init()

[Liam Girdwood]

On Wed, 2014-03-05 at 14:11 +0300, Dan Carpenter wrote:
> Calling "kfree(byt)" is a double free because that was allocated with
> devm_kzalloc().  There were a couple places which leak "byt->msg".  That
> memory is allocated in msg_empty_list_init().
> 

Thanks, we've just fixed this too but were not quicker than you for
upstreaming ;)

Acked-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>

Re: [patch] ASoC: Baytrail: fix error handling in sst_byt_dsp_init()

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 276 bytes --]

On Wed, Mar 05, 2014 at 02:11:57PM +0300, Dan Carpenter wrote:
> Calling "kfree(byt)" is a double free because that was allocated with
> devm_kzalloc().  There were a couple places which leak "byt->msg".  That
> memory is allocated in msg_empty_list_init().

Applied, thanks.

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 836 bytes --]