| Message ID | 73aab53d53df156a5df2bc61314ff26448526749.1693744859.git.christophe.jaillet@wanadoo.fr (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | ALSA: scarlett2: Fix a potential memory leak in scarlett2_init_notify() | expand |
On Sun, 03 Sep 2023 14:41:45 +0200, Christophe JAILLET wrote: > > If kmalloc() fails, we should release 'mixer->urb'. This is released at the common error path in mixer.c, snd_usb_mixer_free(), hence it's not needed. And, even if freeing here, you must NULL-clear mixer->urb, too; otherwise it'll lead to double-free. thanks, Takashi > > Fixes: 9e4d5c1be21f ("ALSA: usb-audio: Scarlett Gen 2 mixer interface") > Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> > --- > sound/usb/mixer_scarlett_gen2.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c > index 9d11bb08667e..a439c7f64b2e 100644 > --- a/sound/usb/mixer_scarlett_gen2.c > +++ b/sound/usb/mixer_scarlett_gen2.c > @@ -4060,8 +4060,10 @@ static int scarlett2_init_notify(struct usb_mixer_interface *mixer) > return -ENOMEM; > > transfer_buffer = kmalloc(private->wMaxPacketSize, GFP_KERNEL); > - if (!transfer_buffer) > + if (!transfer_buffer) { > + usb_free_urb(mixer->urb); > return -ENOMEM; > + } > > usb_fill_int_urb(mixer->urb, dev, pipe, > transfer_buffer, private->wMaxPacketSize, > -- > 2.34.1 >
Le 03/09/2023 à 16:27, Takashi Iwai a écrit : > On Sun, 03 Sep 2023 14:41:45 +0200, > Christophe JAILLET wrote: >> >> If kmalloc() fails, we should release 'mixer->urb'. > > This is released at the common error path in mixer.c, > snd_usb_mixer_free(), hence it's not needed. Agreed, sorry for the noise. CJ > > And, even if freeing here, you must NULL-clear mixer->urb, too; > otherwise it'll lead to double-free. > > > thanks, > > Takashi > >> >> Fixes: 9e4d5c1be21f ("ALSA: usb-audio: Scarlett Gen 2 mixer interface") >> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> >> --- >> sound/usb/mixer_scarlett_gen2.c | 4 +++- >> 1 file changed, 3 insertions(+), 1 deletion(-) >> >> diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c >> index 9d11bb08667e..a439c7f64b2e 100644 >> --- a/sound/usb/mixer_scarlett_gen2.c >> +++ b/sound/usb/mixer_scarlett_gen2.c >> @@ -4060,8 +4060,10 @@ static int scarlett2_init_notify(struct usb_mixer_interface *mixer) >> return -ENOMEM; >> >> transfer_buffer = kmalloc(private->wMaxPacketSize, GFP_KERNEL); >> - if (!transfer_buffer) >> + if (!transfer_buffer) { >> + usb_free_urb(mixer->urb); >> return -ENOMEM; >> + } >> >> usb_fill_int_urb(mixer->urb, dev, pipe, >> transfer_buffer, private->wMaxPacketSize, >> -- >> 2.34.1 >> >
diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c index 9d11bb08667e..a439c7f64b2e 100644 --- a/sound/usb/mixer_scarlett_gen2.c +++ b/sound/usb/mixer_scarlett_gen2.c @@ -4060,8 +4060,10 @@ static int scarlett2_init_notify(struct usb_mixer_interface *mixer) return -ENOMEM; transfer_buffer = kmalloc(private->wMaxPacketSize, GFP_KERNEL); - if (!transfer_buffer) + if (!transfer_buffer) { + usb_free_urb(mixer->urb); return -ENOMEM; + } usb_fill_int_urb(mixer->urb, dev, pipe, transfer_buffer, private->wMaxPacketSize,
If kmalloc() fails, we should release 'mixer->urb'. Fixes: 9e4d5c1be21f ("ALSA: usb-audio: Scarlett Gen 2 mixer interface") Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> --- sound/usb/mixer_scarlett_gen2.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)