summaryrefslogtreecommitdiffstats
path: root/sound/usb
diff options
context:
space:
mode:
authorWenwen Wang <wang6495@umn.edu>2019-04-27 01:06:46 -0500
committerTakashi Iwai <tiwai@suse.de>2019-04-28 09:11:50 +0200
commitcb5173594d50c72b7bfa14113dfc5084b4d2f726 (patch)
tree7c1d80452f789d9024b4e2966236812fdc1bfb6b /sound/usb
parent4ab1ae3453c92940dc752e2c98aa494d3eaedc09 (diff)
downloadlinux-stable-cb5173594d50c72b7bfa14113dfc5084b4d2f726.tar.gz
linux-stable-cb5173594d50c72b7bfa14113dfc5084b4d2f726.tar.bz2
linux-stable-cb5173594d50c72b7bfa14113dfc5084b4d2f726.zip
ALSA: usb-audio: Fix a memory leak bug
In parse_audio_selector_unit(), the string array 'namelist' is allocated through kmalloc_array(), and each string pointer in this array, i.e., 'namelist[]', is allocated through kmalloc() in the following for loop. Then, a control instance 'kctl' is created by invoking snd_ctl_new1(). If an error occurs during the creation process, the string array 'namelist', including all string pointers in the array 'namelist[]', should be freed, before the error code ENOMEM is returned. However, the current code does not free 'namelist[]', resulting in memory leaks. To fix the above issue, free all string pointers 'namelist[]' in a loop. Signed-off-by: Wenwen Wang <wang6495@umn.edu> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de>
Diffstat (limited to 'sound/usb')
-rw-r--r--sound/usb/mixer.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index c095d9751924..e003b5e7b01a 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2675,6 +2675,8 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid,
kctl = snd_ctl_new1(&mixer_selectunit_ctl, cval);
if (! kctl) {
usb_audio_err(state->chip, "cannot malloc kcontrol\n");
+ for (i = 0; i < desc->bNrInPins; i++)
+ kfree(namelist[i]);
kfree(namelist);
kfree(cval);
return -ENOMEM;