2020-08-10 06:43:19

by Dinghao Liu

Subject: [PATCH] ALSA: pci/asihpi: Fix memory leak in snd_card_asihpi_capture_open()

When snd_pcm_hw_constraint_pow2() fails, dpcm should be freed
just like when hpi_instream_open() fails.

Fixes: 719f82d3987aa ("ALSA: Add support of AudioScience ASI boards")
Signed-off-by: Dinghao Liu <[email protected]>
---
sound/pci/asihpi/asihpi.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sound/pci/asihpi/asihpi.c b/sound/pci/asihpi/asihpi.c
index 023c35a2a951..736eceacd3d0 100644
--- a/sound/pci/asihpi/asihpi.c
+++ b/sound/pci/asihpi/asihpi.c
@@ -1244,8 +1244,10 @@ static int snd_card_asihpi_capture_open(struct snd_pcm_substream *substream)
if (card->can_dma)
err = snd_pcm_hw_constraint_pow2(runtime, 0,
SNDRV_PCM_HW_PARAM_BUFFER_BYTES);
- if (err < 0)
+ if (err < 0) {
+ kfree(dpcm);
return err;
+ }

snd_pcm_hw_constraint_step(runtime, 0, SNDRV_PCM_HW_PARAM_PERIOD_SIZE,
card->update_interval_frames);
--
2.17.1

2020-08-10 06:59:24

by Takashi Iwai

Subject: Re: [PATCH] ALSA: pci/asihpi: Fix memory leak in snd_card_asihpi_capture_open()

On Mon, 10 Aug 2020 08:39:55 +0200,
Dinghao Liu wrote:
>
> When snd_pcm_hw_constraint_pow2() fails, dpcm should be freed
> just like when hpi_instream_open() fails.

It will be cleaned up via runtime->private_free call in the caller
side (snd_pcm_open -> snd_pcm_release_substream ->
snd_pcm_detach_substream), hence this would result in double-free.


thanks,

Takashi

>
> Fixes: 719f82d3987aa ("ALSA: Add support of AudioScience ASI boards")
> Signed-off-by: Dinghao Liu <[email protected]>
> ---
> sound/pci/asihpi/asihpi.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/sound/pci/asihpi/asihpi.c b/sound/pci/asihpi/asihpi.c
> index 023c35a2a951..736eceacd3d0 100644
> --- a/sound/pci/asihpi/asihpi.c
> +++ b/sound/pci/asihpi/asihpi.c
> @@ -1244,8 +1244,10 @@ static int snd_card_asihpi_capture_open(struct snd_pcm_substream *substream)
> if (card->can_dma)
> err = snd_pcm_hw_constraint_pow2(runtime, 0,
> SNDRV_PCM_HW_PARAM_BUFFER_BYTES);
> - if (err < 0)
> + if (err < 0) {
> + kfree(dpcm);
> return err;
> + }
>
> snd_pcm_hw_constraint_step(runtime, 0, SNDRV_PCM_HW_PARAM_PERIOD_SIZE,
> card->update_interval_frames);
> --
> 2.17.1
>

2020-08-13 06:42:29

by Dinghao Liu

Subject: Re: Re: [PATCH] ALSA: pci/asihpi: Fix memory leak in snd_card_asihpi_capture_open()

> On Mon, 10 Aug 2020 08:39:55 +0200,
> Dinghao Liu wrote:
> >
> > When snd_pcm_hw_constraint_pow2() fails, dpcm should be freed
> > just like when hpi_instream_open() fails.
>
> It will be cleaned up via runtime->private_free call in the caller
> side (snd_pcm_open -> snd_pcm_release_substream ->
> snd_pcm_detach_substream), hence this would result in double-free.
>

It's clear to me, thanks!

Regards,
Dinghao