diff options
| author | Wenwen Wang <wenwen@cs.uga.edu> | 2019-08-08 00:15:21 -0500 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2019-11-22 15:57:13 +0000 |
| commit | a81c4add9f2966cb2b17406cd62e58a435a95b57 (patch) | |
| tree | 2a306306c8df39c3edce56fe4481533da928c88e /sound | |
| parent | 8e4e88ef41fe4246e731182bb493236b025e30e3 (diff) | |
| download | linux-stable-a81c4add9f2966cb2b17406cd62e58a435a95b57.tar.gz linux-stable-a81c4add9f2966cb2b17406cd62e58a435a95b57.tar.bz2 linux-stable-a81c4add9f2966cb2b17406cd62e58a435a95b57.zip | |
sound: fix a memory leak bug
commit c7cd7c748a3250ca33509f9235efab9c803aca09 upstream.
In sound_insert_unit(), the controlling structure 's' is allocated through
kmalloc(). Then it is added to the sound driver list by invoking
__sound_insert_unit(). Later on, if __register_chrdev() fails, 's' is
removed from the list through __sound_remove_unit(). If 'index' is not less
than 0, -EBUSY is returned to indicate the error. However, 's' is not
deallocated on this execution path, leading to a memory leak bug.
To fix the above issue, free 's' before -EBUSY is returned.
Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/sound_core.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sound/sound_core.c b/sound/sound_core.c index 11e953a1fa45..7ecc2249bfa9 100644 --- a/sound/sound_core.c +++ b/sound/sound_core.c @@ -287,7 +287,8 @@ retry: goto retry; } spin_unlock(&sound_loader_lock); - return -EBUSY; + r = -EBUSY; + goto fail; } } |