diff options
author | Wenwen Wang <wang6495@umn.edu> | 2019-04-27 01:06:46 -0500 |
---|---|---|
committer | Ben Hutchings <ben@decadent.org.uk> | 2019-09-23 21:11:54 +0100 |
commit | 22131d100411351f5dd1b3457ef12d7f2539188d (patch) | |
tree | 56960839e4ca41ae7d676376539a9343c2989b3a /sound | |
parent | 5cd237f44b6f3d8897daa92810839c6e50c3b19d (diff) | |
download | linux-stable-22131d100411351f5dd1b3457ef12d7f2539188d.tar.gz linux-stable-22131d100411351f5dd1b3457ef12d7f2539188d.tar.bz2 linux-stable-22131d100411351f5dd1b3457ef12d7f2539188d.zip |
ALSA: usb-audio: Fix a memory leak bug
commit cb5173594d50c72b7bfa14113dfc5084b4d2f726 upstream.
In parse_audio_selector_unit(), the string array 'namelist' is allocated
through kmalloc_array(), and each string pointer in this array, i.e.,
'namelist[]', is allocated through kmalloc() in the following for loop.
Then, a control instance 'kctl' is created by invoking snd_ctl_new1(). If
an error occurs during the creation process, the string array 'namelist',
including all string pointers in the array 'namelist[]', should be freed,
before the error code ENOMEM is returned. However, the current code does
not free 'namelist[]', resulting in memory leaks.
To fix the above issue, free all string pointers 'namelist[]' in a loop.
Signed-off-by: Wenwen Wang <wang6495@umn.edu>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'sound')
-rw-r--r-- | sound/usb/mixer.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c index e08a859ee997..b5d95e2c2ed5 100644 --- a/sound/usb/mixer.c +++ b/sound/usb/mixer.c @@ -2090,6 +2090,8 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid, kctl = snd_ctl_new1(&mixer_selectunit_ctl, cval); if (! kctl) { usb_audio_err(state->chip, "cannot malloc kcontrol\n"); + for (i = 0; i < desc->bNrInPins; i++) + kfree(namelist[i]); kfree(namelist); kfree(cval); return -ENOMEM; |