| Message ID | 20210715005625.GA1997259@pc |
|---|---|
| State | New |
| Headers | show |
| Series | sound: usb: line6: free allocated urbs on failure | expand |
On Thu, 15 Jul 2021 02:56:25 +0200, Salah Triki wrote: > > Free allocated urbs on failure in order to prevent memory leaks. > > Signed-off-by: Salah Triki <salah.triki@gmail.com> This will lead to double-free. The resources are freed in the destructor of PCM component, line6_cleanup_pcm(). Takashi > --- > sound/usb/line6/capture.c | 22 ++++++++++++++++++---- > 1 file changed, 18 insertions(+), 4 deletions(-) > > diff --git a/sound/usb/line6/capture.c b/sound/usb/line6/capture.c > index 970c9bdce0b2..345b75ede5d5 100644 > --- a/sound/usb/line6/capture.c > +++ b/sound/usb/line6/capture.c > @@ -258,6 +258,7 @@ int line6_create_audio_in_urbs(struct snd_line6_pcm *line6pcm) > { > struct usb_line6 *line6 = line6pcm->line6; > int i; > + int ret; > > line6pcm->in.urbs = kcalloc(line6->iso_buffers, sizeof(struct urb *), > GFP_KERNEL); > @@ -272,8 +273,10 @@ int line6_create_audio_in_urbs(struct snd_line6_pcm *line6pcm) > urb = line6pcm->in.urbs[i] = > usb_alloc_urb(LINE6_ISO_PACKETS, GFP_KERNEL); > > - if (urb == NULL) > - return -ENOMEM; > + if (urb == NULL) { > + ret = -ENOMEM; > + goto enomem; > + } > > urb->dev = line6->usbdev; > urb->pipe = > @@ -286,9 +289,20 @@ int line6_create_audio_in_urbs(struct snd_line6_pcm *line6pcm) > urb->interval = LINE6_ISO_INTERVAL; > urb->error_count = 0; > urb->complete = audio_in_callback; > - if (usb_urb_ep_type_check(urb)) > - return -EINVAL; > + if (usb_urb_ep_type_check(urb)) { > + ret = -EINVAL; > + goto einval; > + } > } > > return 0; > + > +enomem: > + i--; > + > +einval: > + while (i >= 0) > + usb_free_urb(line6pcm->in.urbs[i--]); > + > + return ret; > } > -- > 2.25.1 >
diff --git a/sound/usb/line6/capture.c b/sound/usb/line6/capture.c index 970c9bdce0b2..345b75ede5d5 100644 --- a/sound/usb/line6/capture.c +++ b/sound/usb/line6/capture.c @@ -258,6 +258,7 @@ int line6_create_audio_in_urbs(struct snd_line6_pcm *line6pcm) { struct usb_line6 *line6 = line6pcm->line6; int i; + int ret; line6pcm->in.urbs = kcalloc(line6->iso_buffers, sizeof(struct urb *), GFP_KERNEL); @@ -272,8 +273,10 @@ int line6_create_audio_in_urbs(struct snd_line6_pcm *line6pcm) urb = line6pcm->in.urbs[i] = usb_alloc_urb(LINE6_ISO_PACKETS, GFP_KERNEL); - if (urb == NULL) - return -ENOMEM; + if (urb == NULL) { + ret = -ENOMEM; + goto enomem; + } urb->dev = line6->usbdev; urb->pipe = @@ -286,9 +289,20 @@ int line6_create_audio_in_urbs(struct snd_line6_pcm *line6pcm) urb->interval = LINE6_ISO_INTERVAL; urb->error_count = 0; urb->complete = audio_in_callback; - if (usb_urb_ep_type_check(urb)) - return -EINVAL; + if (usb_urb_ep_type_check(urb)) { + ret = -EINVAL; + goto einval; + } } return 0; + +enomem: + i--; + +einval: + while (i >= 0) + usb_free_urb(line6pcm->in.urbs[i--]); + + return ret; }
Free allocated urbs on failure in order to prevent memory leaks. Signed-off-by: Salah Triki <salah.triki@gmail.com> --- sound/usb/line6/capture.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-)