linux-kernel - Re: [alsa-devel] [PATCH] [ASoC][soc-dapm] : memory leak in the func snd_soc_dapm_new

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date:   Mon, 29 Jul 2019 09:18:35 +0100
From:   Charles Keepax <ckeepax@...nsource.cirrus.com>
To:     Satendra Singh Thakur <thakursatendra2003@...oo.co.in>
CC:     <alsa-devel@...a-project.org>, Liam Girdwood <lgirdwood@...il.com>,
        <linux-kernel@...r.kernel.org>, Takashi Iwai <tiwai@...e.com>,
        Mark Brown <broonie@...nel.org>
Subject: Re: [alsa-devel] [PATCH] [ASoC][soc-dapm] : memory leak in the func
 snd_soc_dapm_new_dai

On Thu, Jul 25, 2019 at 09:43:35PM +0530, Satendra Singh Thakur wrote:
> In the func snd_soc_dapm_new_dai, if the inner func
> snd_soc_dapm_alloc_kcontrol fails, there will be memory leak.
> The label param_fail wont free memory which is allocated by
> the func devm_kcalloc. Hence new label is created for this purpose.
> 
> Signed-off-by: Satendra Singh Thakur <thakursatendra2003@...oo.co.in>
> ---
>  sound/soc/soc-dapm.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
> index f013b24c050a..f62d41ee6d68 100644
> --- a/sound/soc/soc-dapm.c
> +++ b/sound/soc/soc-dapm.c
> @@ -4095,7 +4095,7 @@ snd_soc_dapm_new_dai(struct snd_soc_card *card, struct snd_soc_pcm_runtime *rtd,
>  						w_param_text, &private_value);
>  		if (!template.kcontrol_news) {
>  			ret = -ENOMEM;
> -			goto param_fail;
> +			goto outfree_w_param;
>  		}
>  	} else {
>  		w_param_text = NULL;
> @@ -4114,6 +4114,7 @@ snd_soc_dapm_new_dai(struct snd_soc_card *card, struct snd_soc_pcm_runtime *rtd,
>  
>  outfree_kcontrol_news:
>  	devm_kfree(card->dev, (void *)template.kcontrol_news);
> +outfree_w_param:
>  	snd_soc_dapm_free_kcontrol(card, &private_value,
>  				   rtd->dai_link->num_params, w_param_text);

This is not necessary snd_soc_dapm_alloc_kcontrol calls
snd_soc_dapm_free_kcontrol on its internal error path.

Thanks,
Charles