Merge "ALSA: usb-audio: Fix double-free in error paths after snd_usb_add_audio_stream() call" (da30dd5c) · Commits · e / devices / android_kernel_xiaomi_markw

sound/usb/quirks.c

+8 −0

Original line number	Diff line number	Diff line
		@@ -138,7 +138,9 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
		usb_audio_err(chip, "cannot memdup\n");
		return -ENOMEM;
		}
		INIT_LIST_HEAD(&fp->list);
		if (fp->nr_rates > MAX_NR_RATES) {
		list_del(&fp->list);
		kfree(fp);
		return -EINVAL;
		}
		@@ -146,6 +148,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
		rate_table = kmemdup(fp->rate_table,
		sizeof(int) * fp->nr_rates, GFP_KERNEL);
		if (!rate_table) {
		list_del(&fp->list);
		kfree(fp);
		return -ENOMEM;
		}
		@@ -156,12 +159,14 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
		? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK;
		err = snd_usb_add_audio_stream(chip, stream, fp);
		if (err < 0) {
		list_del(&fp->list);
		kfree(fp);
		kfree(rate_table);
		return err;
		}
		if (fp->iface != get_iface_desc(&iface->altsetting[0])->bInterfaceNumber \|\|
		fp->altset_idx >= iface->num_altsetting) {
		list_del(&fp->list);
		kfree(fp);
		kfree(rate_table);
		return -EINVAL;
		@@ -169,6 +174,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
		alts = &iface->altsetting[fp->altset_idx];
		altsd = get_iface_desc(alts);
		if (altsd->bNumEndpoints < 1) {
		list_del(&fp->list);
		kfree(fp);
		kfree(rate_table);
		return -EINVAL;
		@@ -456,6 +462,7 @@ static int create_uaxx_quirk(struct snd_usb_audio *chip,
		fp->ep_attr = get_endpoint(alts, 0)->bmAttributes;
		fp->datainterval = 0;
		fp->maxpacksize = le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize);
		INIT_LIST_HEAD(&fp->list);

		switch (fp->maxpacksize) {
		case 0x120:
		@@ -479,6 +486,7 @@ static int create_uaxx_quirk(struct snd_usb_audio *chip,
		? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK;
		err = snd_usb_add_audio_stream(chip, stream, fp);
		if (err < 0) {
		list_del(&fp->list); /* unlink for avoiding double-free */
		kfree(fp);
		return err;
		}

sound/usb/stream.c

+5 −1

Original line number	Diff line number	Diff line
		@@ -315,7 +315,9 @@ static struct snd_pcm_chmap_elem *convert_chmap(int channels, unsigned int bits,
		/*
		* add this endpoint to the chip instance.
		* if a stream with the same endpoint already exists, append to it.
		* if not, create a new pcm stream.
		* if not, create a new pcm stream. note, fp is added to the substream
		* fmt_list and will be freed on the chip instance release. do not free
		* fp or do remove it from the substream fmt_list to avoid double-free.
		*/
		int snd_usb_add_audio_stream(struct snd_usb_audio *chip,
		int stream,
		@@ -668,6 +670,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no)
		* (fp->maxpacksize & 0x7ff);
		fp->attributes = parse_uac_endpoint_attributes(chip, alts, protocol, iface_no);
		fp->clock = clock;
		INIT_LIST_HEAD(&fp->list);

		/* some quirks for attributes here */

		@@ -716,6 +719,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no)
		dev_dbg(&dev->dev, "%u:%d: add audio endpoint %#x\n", iface_no, altno, fp->endpoint);
		err = snd_usb_add_audio_stream(chip, stream, fp);
		if (err < 0) {
		list_del(&fp->list); /* unlink for avoiding double-free */
		kfree(fp->rate_table);
		kfree(fp->chmap);
		kfree(fp);