Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Tue, 06 Aug 2019 08:40:23 +0200
Message-ID: <s5h36iepzjc.wl-tiwai@suse.de>
From:   Takashi Iwai <tiwai@suse.de>
To:     Wenwen Wang <wenwen@cs.uga.edu>
Cc:     "moderated list:SOUND" <alsa-devel@alsa-project.org>,
        Thomas Gleixner <tglx@linutronix.de>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Kate Stewart <kstewart@linuxfoundation.org>,
        Allison Randal <allison@lohutok.net>,
        Jaroslav Kysela <perex@perex.cz>,
        Richard Fontana <rfontana@redhat.com>,
        Takashi Iwai <tiwai@suse.com>,
        open list <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] ALSA: usb-audio: fix a memory leak bug
In-Reply-To: <CAAa=b7eiG_rpjfL8c-dWjpxSf3XPJxJbcVPrE1W0_1j-9s1QEg@mail.gmail.com>
References: <CAAa=b7eiG_rpjfL8c-dWjpxSf3XPJxJbcVPrE1W0_1j-9s1QEg@mail.gmail.com>
User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka)
 FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/25.3
 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO)
MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka")
Content-Type: text/plain; charset=US-ASCII
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Tue, 06 Aug 2019 08:13:06 +0200,
Wenwen Wang wrote:
> 
> In add_new_ctl(), a mixer element structure is allocated through kzalloc()
> and the pointer is saved to 'elem'. Later on, a new alsa control element is
> created and added to this structure. In case the add process fails, i.e.,
> the return value of snd_usb_mixer_add_control() is less than 0, the
> allocated structure is not freed, leading to a memory leak.
> 
> To fix the above issue, free 'elem' before returning the error.
> 
> Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>

It's a false-positive.  snd_ctl_add() behaves differently from others,
it releases the given kctl at the error.  And in this case, elem
already gets freed by kctl->private_free callback.


thanks,

Takashi