tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
fork atom

ALSA: ASoC: Fix double free and memory leak in many codec drivers

Many SoC audio codec drivers have improper freeing of memory in error
paths.

* codec is allocated in the platform device probe function, but is not
freed there in case of error. Instead it is freed in the i2c device
probe function's error path. However the success or failure of both
functions is not linked, so this could result in a double free (if
the platform device is successfully probed, the i2c device probing
fails and then the platform driver is unregistered.)

* codec->private_data is allocated in many platform device probe
functions but not freed in their error paths.

This patch hopefully solves all these problems.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

authored by Jean Delvare and committed by Takashi Iwai 3051e41a c5d44423

+51 -32
unified split
+7 -4
sound/soc/codecs/ak4535.c
··· 562 562 client_template.addr = addr; 563 563 564 564 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 565 - if (i2c == NULL) { 566 - kfree(codec); 565 + if (i2c == NULL) 567 566 return -ENOMEM; 568 - } 567 + 569 568 i2c_set_clientdata(i2c, codec); 570 569 codec->control_data = i2c; 571 570 ··· 582 583 return ret; 583 584 584 585 err: 585 - kfree(codec); 586 586 kfree(i2c); 587 587 return ret; 588 588 } ··· 658 660 #else 659 661 /* Add other interfaces here */ 660 662 #endif 663 + 664 + if (ret != 0) { 665 + kfree(codec->private_data); 666 + kfree(codec); 667 + } 661 668 return ret; 662 669 } 663 670
+7 -4
sound/soc/codecs/tlv320aic3x.c
··· 1199 1199 client_template.addr = addr; 1200 1200 1201 1201 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 1202 - if (i2c == NULL) { 1203 - kfree(codec); 1202 + if (i2c == NULL) 1204 1203 return -ENOMEM; 1205 - } 1204 + 1206 1205 i2c_set_clientdata(i2c, codec); 1207 1206 codec->control_data = i2c; 1208 1207 ··· 1220 1221 return ret; 1221 1222 1222 1223 err: 1223 - kfree(codec); 1224 1224 kfree(i2c); 1225 1225 return ret; 1226 1226 } ··· 1300 1302 #else 1301 1303 /* Add other interfaces here */ 1302 1304 #endif 1305 + 1306 + if (ret != 0) { 1307 + kfree(codec->private_data); 1308 + kfree(codec); 1309 + } 1303 1310 return ret; 1304 1311 } 1305 1312
+5 -4
sound/soc/codecs/uda1380.c
··· 729 729 client_template.addr = addr; 730 730 731 731 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 732 - if (i2c == NULL) { 733 - kfree(codec); 732 + if (i2c == NULL) 734 733 return -ENOMEM; 735 - } 734 + 736 735 i2c_set_clientdata(i2c, codec); 737 736 codec->control_data = i2c; 738 737 ··· 749 750 return ret; 750 751 751 752 err: 752 - kfree(codec); 753 753 kfree(i2c); 754 754 return ret; 755 755 } ··· 815 817 #else 816 818 /* Add other interfaces here */ 817 819 #endif 820 + 821 + if (ret != 0) 822 + kfree(codec); 818 823 return ret; 819 824 } 820 825
+5 -4
sound/soc/codecs/wm8510.c
··· 693 693 client_template.addr = addr; 694 694 695 695 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 696 - if (i2c == NULL) { 697 - kfree(codec); 696 + if (i2c == NULL) 698 697 return -ENOMEM; 699 - } 698 + 700 699 i2c_set_clientdata(i2c, codec); 701 700 codec->control_data = i2c; 702 701 ··· 713 714 return ret; 714 715 715 716 err: 716 - kfree(codec); 717 717 kfree(i2c); 718 718 return ret; 719 719 } ··· 780 782 #else 781 783 /* Add other interfaces here */ 782 784 #endif 785 + 786 + if (ret != 0) 787 + kfree(codec); 783 788 return ret; 784 789 } 785 790
+7 -4
sound/soc/codecs/wm8731.c
··· 596 596 client_template.addr = addr; 597 597 598 598 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 599 - if (i2c == NULL) { 600 - kfree(codec); 599 + if (i2c == NULL) 601 600 return -ENOMEM; 602 - } 601 + 603 602 i2c_set_clientdata(i2c, codec); 604 603 codec->control_data = i2c; 605 604 ··· 616 617 return ret; 617 618 618 619 err: 619 - kfree(codec); 620 620 kfree(i2c); 621 621 return ret; 622 622 } ··· 691 693 #else 692 694 /* Add other interfaces here */ 693 695 #endif 696 + 697 + if (ret != 0) { 698 + kfree(codec->private_data); 699 + kfree(codec); 700 + } 694 701 return ret; 695 702 } 696 703
+6 -4
sound/soc/codecs/wm8750.c
··· 869 869 client_template.addr = addr; 870 870 871 871 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 872 - if (i2c == NULL) { 873 - kfree(codec); 872 + if (i2c == NULL) 874 873 return -ENOMEM; 875 - } 874 + 876 875 i2c_set_clientdata(i2c, codec); 877 876 codec->control_data = i2c; 878 877 ··· 889 890 return ret; 890 891 891 892 err: 892 - kfree(codec); 893 893 kfree(i2c); 894 894 return ret; 895 895 } ··· 964 966 /* Add other interfaces here */ 965 967 #endif 966 968 969 + if (ret != 0) { 970 + kfree(codec->private_data); 971 + kfree(codec); 972 + } 967 973 return ret; 968 974 } 969 975
+7 -4
sound/soc/codecs/wm8753.c
··· 1661 1661 client_template.addr = addr; 1662 1662 1663 1663 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 1664 - if (!i2c) { 1665 - kfree(codec); 1664 + if (!i2c) 1666 1665 return -ENOMEM; 1667 - } 1666 + 1668 1667 i2c_set_clientdata(i2c, codec); 1669 1668 codec->control_data = i2c; 1670 1669 ··· 1682 1683 return ret; 1683 1684 1684 1685 err: 1685 - kfree(codec); 1686 1686 kfree(i2c); 1687 1687 return ret; 1688 1688 } ··· 1758 1760 #else 1759 1761 /* Add other interfaces here */ 1760 1762 #endif 1763 + 1764 + if (ret != 0) { 1765 + kfree(codec->private_data); 1766 + kfree(codec); 1767 + } 1761 1768 return ret; 1762 1769 } 1763 1770
+7 -4
sound/soc/codecs/wm8990.c
··· 1500 1500 client_template.addr = addr; 1501 1501 1502 1502 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 1503 - if (i2c == NULL) { 1504 - kfree(codec); 1503 + if (i2c == NULL) 1505 1504 return -ENOMEM; 1506 - } 1505 + 1507 1506 i2c_set_clientdata(i2c, codec); 1508 1507 codec->control_data = i2c; 1509 1508 ··· 1520 1521 return ret; 1521 1522 1522 1523 err: 1523 - kfree(codec); 1524 1524 kfree(i2c); 1525 1525 return ret; 1526 1526 } ··· 1593 1595 #else 1594 1596 /* Add other interfaces here */ 1595 1597 #endif 1598 + 1599 + if (ret != 0) { 1600 + kfree(codec->private_data); 1601 + kfree(codec); 1602 + } 1596 1603 return ret; 1597 1604 } 1598 1605