In __snd_usbmidi_create(), a MIDI streaming interface structure is
allocated through kzalloc() and the pointer is saved to 'umidi'. Later on,
the endpoint structures are created by invoking
snd_usbmidi_create_endpoints_midiman() or snd_usbmidi_create_endpoints(),
depending on the type of the audio quirk type. However, if the creation
fails, the allocated 'umidi' is not deallocated, leading to a memory leak
bug.
To fix the above issue, free 'umidi' before returning the error.
Signed-off-by: Wenwen Wang <[email protected]>
---
sound/usb/midi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/usb/midi.c b/sound/usb/midi.c
index b737f0e..22db37f 100644
--- a/sound/usb/midi.c
+++ b/sound/usb/midi.c
@@ -2476,7 +2476,7 @@ int __snd_usbmidi_create(struct snd_card *card,
else
err = snd_usbmidi_create_endpoints(umidi, endpoints);
if (err < 0)
- goto exit;
+ goto free_midi;
usb_autopm_get_interface_no_resume(umidi->iface);
--
2.7.4
On Wed, 07 Aug 2019 05:22:09 +0200,
Wenwen Wang wrote:
>
> In __snd_usbmidi_create(), a MIDI streaming interface structure is
> allocated through kzalloc() and the pointer is saved to 'umidi'. Later on,
> the endpoint structures are created by invoking
> snd_usbmidi_create_endpoints_midiman() or snd_usbmidi_create_endpoints(),
> depending on the type of the audio quirk type. However, if the creation
> fails, the allocated 'umidi' is not deallocated, leading to a memory leak
> bug.
>
> To fix the above issue, free 'umidi' before returning the error.
>
> Signed-off-by: Wenwen Wang <[email protected]>
It's again a false-positive report. The object is released
automatically by the destructor of its base snd_rawmidi object.
thanks,
Takashi
On Wed, Aug 7, 2019 at 1:31 AM Takashi Iwai <[email protected]> wrote:
>
> On Wed, 07 Aug 2019 05:22:09 +0200,
> Wenwen Wang wrote:
> >
> > In __snd_usbmidi_create(), a MIDI streaming interface structure is
> > allocated through kzalloc() and the pointer is saved to 'umidi'. Later on,
> > the endpoint structures are created by invoking
> > snd_usbmidi_create_endpoints_midiman() or snd_usbmidi_create_endpoints(),
> > depending on the type of the audio quirk type. However, if the creation
> > fails, the allocated 'umidi' is not deallocated, leading to a memory leak
> > bug.
> >
> > To fix the above issue, free 'umidi' before returning the error.
> >
> > Signed-off-by: Wenwen Wang <[email protected]>
>
> It's again a false-positive report. The object is released
> automatically by the destructor of its base snd_rawmidi object.
Thanks for your response! Sorry for the false positives. :(
Wenwen