Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1c286e4e authored by Wenwen Wang's avatar Wenwen Wang Committed by Greg Kroah-Hartman
Browse files

ALSA: hiface: fix multiple memory leak bugs 



commit 3d92aa45fbfd7319e3a19f4ec59fd32b3862b723 upstream.

In hiface_pcm_init(), 'rt' is firstly allocated through kzalloc(). Later
on, hiface_pcm_init_urb() is invoked to initialize 'rt->out_urbs[i]'. In
hiface_pcm_init_urb(), 'rt->out_urbs[i].buffer' is allocated through
kzalloc().  However, if hiface_pcm_init_urb() fails, both 'rt' and
'rt->out_urbs[i].buffer' are not deallocated, leading to memory leak bugs.
Also, 'rt->out_urbs[i].buffer' is not deallocated if snd_pcm_new() fails.

To fix the above issues, free 'rt' and 'rt->out_urbs[i].buffer'.

Fixes: a91c3fb2 ("Add M2Tech hiFace USB-SPDIF driver")
Signed-off-by: default avatarWenwen Wang <wenwen@cs.uga.edu>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent bc972b6b

sound/usb/hiface/pcm.c

+8 −3
Original line number Diff line number Diff line
@@ -604,14 +604,13 @@ int hiface_pcm_init(struct hiface_chip *chip, u8 extra_freq) 
		ret = hiface_pcm_init_urb(&rt->out_urbs[i], chip, OUT_EP,

				    hiface_pcm_out_urb_handler);

		if (ret < 0)

			return ret;

			goto error;

	}



	ret = snd_pcm_new(chip->card, "USB-SPDIF Audio", 0, 1, 0, &pcm);

	if (ret < 0) {

		kfree(rt);

		dev_err(&chip->dev->dev, "Cannot create pcm instance\n");

		return ret;

		goto error;

	}



	pcm->private_data = rt;
@@ -624,4 +623,10 @@ int hiface_pcm_init(struct hiface_chip *chip, u8 extra_freq) 


	chip->pcm = rt;

	return 0;



error:

	for (i = 0; i < PCM_N_URBS; i++)

		kfree(rt->out_urbs[i].buffer);

	kfree(rt);

	return ret;

}