tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
fork atom

ALSA: ASoC: Fix double free and memory leak in many codec drivers

Many SoC audio codec drivers have improper freeing of memory in error
paths.

* codec is allocated in the platform device probe function, but is not
freed there in case of error. Instead it is freed in the i2c device
probe function's error path. However the success or failure of both
functions is not linked, so this could result in a double free (if
the platform device is successfully probed, the i2c device probing
fails and then the platform driver is unregistered.)

* codec->private_data is allocated in many platform device probe
functions but not freed in their error paths.

This patch hopefully solves all these problems.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

authored by Jean Delvare and committed by Takashi Iwai 3051e41a c5d44423

+51 -32
unified split
+7 -4
sound/soc/codecs/ak4535.c
··· 562 client_template.addr = addr; 563 564 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 565 - if (i2c == NULL) { 566 - kfree(codec); 567 return -ENOMEM; 568 - } 569 i2c_set_clientdata(i2c, codec); 570 codec->control_data = i2c; 571 ··· 582 return ret; 583 584 err: 585 - kfree(codec); 586 kfree(i2c); 587 return ret; 588 } ··· 658 #else 659 /* Add other interfaces here */ 660 #endif 661 return ret; 662 } 663
··· 562 client_template.addr = addr; 563 564 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 565 + if (i2c == NULL) 566 return -ENOMEM; 567 + 568 i2c_set_clientdata(i2c, codec); 569 codec->control_data = i2c; 570 ··· 583 return ret; 584 585 err: 586 kfree(i2c); 587 return ret; 588 } ··· 660 #else 661 /* Add other interfaces here */ 662 #endif 663 + 664 + if (ret != 0) { 665 + kfree(codec->private_data); 666 + kfree(codec); 667 + } 668 return ret; 669 } 670
+7 -4
sound/soc/codecs/tlv320aic3x.c
··· 1199 client_template.addr = addr; 1200 1201 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 1202 - if (i2c == NULL) { 1203 - kfree(codec); 1204 return -ENOMEM; 1205 - } 1206 i2c_set_clientdata(i2c, codec); 1207 codec->control_data = i2c; 1208 ··· 1220 return ret; 1221 1222 err: 1223 - kfree(codec); 1224 kfree(i2c); 1225 return ret; 1226 } ··· 1300 #else 1301 /* Add other interfaces here */ 1302 #endif 1303 return ret; 1304 } 1305
··· 1199 client_template.addr = addr; 1200 1201 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 1202 + if (i2c == NULL) 1203 return -ENOMEM; 1204 + 1205 i2c_set_clientdata(i2c, codec); 1206 codec->control_data = i2c; 1207 ··· 1221 return ret; 1222 1223 err: 1224 kfree(i2c); 1225 return ret; 1226 } ··· 1302 #else 1303 /* Add other interfaces here */ 1304 #endif 1305 + 1306 + if (ret != 0) { 1307 + kfree(codec->private_data); 1308 + kfree(codec); 1309 + } 1310 return ret; 1311 } 1312
+5 -4
sound/soc/codecs/uda1380.c
··· 729 client_template.addr = addr; 730 731 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 732 - if (i2c == NULL) { 733 - kfree(codec); 734 return -ENOMEM; 735 - } 736 i2c_set_clientdata(i2c, codec); 737 codec->control_data = i2c; 738 ··· 749 return ret; 750 751 err: 752 - kfree(codec); 753 kfree(i2c); 754 return ret; 755 } ··· 815 #else 816 /* Add other interfaces here */ 817 #endif 818 return ret; 819 } 820
··· 729 client_template.addr = addr; 730 731 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 732 + if (i2c == NULL) 733 return -ENOMEM; 734 + 735 i2c_set_clientdata(i2c, codec); 736 codec->control_data = i2c; 737 ··· 750 return ret; 751 752 err: 753 kfree(i2c); 754 return ret; 755 } ··· 817 #else 818 /* Add other interfaces here */ 819 #endif 820 + 821 + if (ret != 0) 822 + kfree(codec); 823 return ret; 824 } 825
+5 -4
sound/soc/codecs/wm8510.c
··· 693 client_template.addr = addr; 694 695 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 696 - if (i2c == NULL) { 697 - kfree(codec); 698 return -ENOMEM; 699 - } 700 i2c_set_clientdata(i2c, codec); 701 codec->control_data = i2c; 702 ··· 713 return ret; 714 715 err: 716 - kfree(codec); 717 kfree(i2c); 718 return ret; 719 } ··· 780 #else 781 /* Add other interfaces here */ 782 #endif 783 return ret; 784 } 785
··· 693 client_template.addr = addr; 694 695 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 696 + if (i2c == NULL) 697 return -ENOMEM; 698 + 699 i2c_set_clientdata(i2c, codec); 700 codec->control_data = i2c; 701 ··· 714 return ret; 715 716 err: 717 kfree(i2c); 718 return ret; 719 } ··· 782 #else 783 /* Add other interfaces here */ 784 #endif 785 + 786 + if (ret != 0) 787 + kfree(codec); 788 return ret; 789 } 790
+7 -4
sound/soc/codecs/wm8731.c
··· 596 client_template.addr = addr; 597 598 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 599 - if (i2c == NULL) { 600 - kfree(codec); 601 return -ENOMEM; 602 - } 603 i2c_set_clientdata(i2c, codec); 604 codec->control_data = i2c; 605 ··· 616 return ret; 617 618 err: 619 - kfree(codec); 620 kfree(i2c); 621 return ret; 622 } ··· 691 #else 692 /* Add other interfaces here */ 693 #endif 694 return ret; 695 } 696
··· 596 client_template.addr = addr; 597 598 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 599 + if (i2c == NULL) 600 return -ENOMEM; 601 + 602 i2c_set_clientdata(i2c, codec); 603 codec->control_data = i2c; 604 ··· 617 return ret; 618 619 err: 620 kfree(i2c); 621 return ret; 622 } ··· 693 #else 694 /* Add other interfaces here */ 695 #endif 696 + 697 + if (ret != 0) { 698 + kfree(codec->private_data); 699 + kfree(codec); 700 + } 701 return ret; 702 } 703
+6 -4
sound/soc/codecs/wm8750.c
··· 869 client_template.addr = addr; 870 871 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 872 - if (i2c == NULL) { 873 - kfree(codec); 874 return -ENOMEM; 875 - } 876 i2c_set_clientdata(i2c, codec); 877 codec->control_data = i2c; 878 ··· 889 return ret; 890 891 err: 892 - kfree(codec); 893 kfree(i2c); 894 return ret; 895 } ··· 964 /* Add other interfaces here */ 965 #endif 966 967 return ret; 968 } 969
··· 869 client_template.addr = addr; 870 871 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 872 + if (i2c == NULL) 873 return -ENOMEM; 874 + 875 i2c_set_clientdata(i2c, codec); 876 codec->control_data = i2c; 877 ··· 890 return ret; 891 892 err: 893 kfree(i2c); 894 return ret; 895 } ··· 966 /* Add other interfaces here */ 967 #endif 968 969 + if (ret != 0) { 970 + kfree(codec->private_data); 971 + kfree(codec); 972 + } 973 return ret; 974 } 975
+7 -4
sound/soc/codecs/wm8753.c
··· 1661 client_template.addr = addr; 1662 1663 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 1664 - if (!i2c) { 1665 - kfree(codec); 1666 return -ENOMEM; 1667 - } 1668 i2c_set_clientdata(i2c, codec); 1669 codec->control_data = i2c; 1670 ··· 1682 return ret; 1683 1684 err: 1685 - kfree(codec); 1686 kfree(i2c); 1687 return ret; 1688 } ··· 1758 #else 1759 /* Add other interfaces here */ 1760 #endif 1761 return ret; 1762 } 1763
··· 1661 client_template.addr = addr; 1662 1663 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 1664 + if (!i2c) 1665 return -ENOMEM; 1666 + 1667 i2c_set_clientdata(i2c, codec); 1668 codec->control_data = i2c; 1669 ··· 1683 return ret; 1684 1685 err: 1686 kfree(i2c); 1687 return ret; 1688 } ··· 1760 #else 1761 /* Add other interfaces here */ 1762 #endif 1763 + 1764 + if (ret != 0) { 1765 + kfree(codec->private_data); 1766 + kfree(codec); 1767 + } 1768 return ret; 1769 } 1770
+7 -4
sound/soc/codecs/wm8990.c
··· 1500 client_template.addr = addr; 1501 1502 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 1503 - if (i2c == NULL) { 1504 - kfree(codec); 1505 return -ENOMEM; 1506 - } 1507 i2c_set_clientdata(i2c, codec); 1508 codec->control_data = i2c; 1509 ··· 1520 return ret; 1521 1522 err: 1523 - kfree(codec); 1524 kfree(i2c); 1525 return ret; 1526 } ··· 1593 #else 1594 /* Add other interfaces here */ 1595 #endif 1596 return ret; 1597 } 1598
··· 1500 client_template.addr = addr; 1501 1502 i2c = kmemdup(&client_template, sizeof(client_template), GFP_KERNEL); 1503 + if (i2c == NULL) 1504 return -ENOMEM; 1505 + 1506 i2c_set_clientdata(i2c, codec); 1507 codec->control_data = i2c; 1508 ··· 1521 return ret; 1522 1523 err: 1524 kfree(i2c); 1525 return ret; 1526 } ··· 1595 #else 1596 /* Add other interfaces here */ 1597 #endif 1598 + 1599 + if (ret != 0) { 1600 + kfree(codec->private_data); 1601 + kfree(codec); 1602 + } 1603 return ret; 1604 } 1605