Skip to contentSkip to conversation

staging: intel_sst: Fix memory leak

PATCH In review Andre Bartke 3 participants 3 messages May 31, 2011 – Jun 1, 2011 Staging

lore
Share & tools
lore

Andre Bartke

author
#0 lore raw

PATCH 1/1 staging: intel_sst: Fix memory leak

In case of an error stream_bufs is not freed here.

Signed-off-by Andre Bartke <[email protected]>
---
 .../staging/intel_sst/intel_sst_app_interface.c    |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)
drivers/staging/intel_sst/intel_sst_app_interface.c +3 -1
index b8c7ddb..93b41a2 100644
@@ -430,8 +430,10 @@ static int snd_sst_fill_kernel_list(struct stream_info *stream,
 				return -ENOMEM;
 			if (copy_from_user((void *) &rar_handle,
 					iovec[index].iov_base,
-					sizeof(__u32)))
+					sizeof(__u32))) {
+				kfree(stream_bufs);
 				return -EFAULT;
+			}
 			stream_bufs->addr = (char *)rar_handle;
 			stream_bufs->in_use = false;
 			stream_bufs->size = iovec[0].iov_len;
Signature · 1 line
1.7.5.2
#1 lore raw
Quoted 12 lines · Andre Bartke

In case of an error stream_bufs is not freed here.

Signed-off-by Andre Bartke <[email protected]>
---
 .../staging/intel_sst/intel_sst_app_interface.c    |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)
drivers/staging/intel_sst/intel_sst_app_interface.c +0 -0
index b8c7ddb..93b41a2 100644

drivers/staging/intel_sst/intel_sst_app_interface.c static int snd_sst_fill_kernel_list(struct stream_info *stream, · line 437

Quoted 9 lines
drivers/staging/intel_sst/intel_sst_app_interface.c +3 -1
@@ -430,8 +430,10 @@ static int snd_sst_fill_kernel_list(struct stream_info *stream,
 				return -ENOMEM;
 			if (copy_from_user((void *) &rar_handle,
 					iovec[index].iov_base,
-					sizeof(__u32)))
+					sizeof(__u32))) {
+				kfree(stream_bufs);
 				return -EFAULT;
+			}
 			stream_bufs->addr = (char *)rar_handle;

Btw, the original code looks seems pretty awful. "rar_handle" is a kernel pointer that we get from user space. It is a u32 type so this won't work under a 64 bit OS.

These allocations get added to a list. Maybe we should free them all? It's hard to say. There is only one place that calls this function, and it ignores the return value.

regards,
dan carpenter