Skip to contentSkip to conversation

ASoC: Baytrail: fix error handling in sst_byt_dsp_init()

PATCH Applied Dan Carpenter 3 participants 3 messages Mar 5, 2014 – Mar 6, 2014

Subsystems (4)
Sound Kernel janitors ASoC Intel ASoC drivers
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 ASoC: Baytrail: fix error handling in sst_byt_dsp_init()

Calling "kfree(byt)" is a double free because that was allocated with devm_kzalloc(). There were a couple places which leak "byt->msg". That memory is allocated in msg_empty_list_init().

Fixes f7d01fd6754c ('ASoC: Intel: Add Intel Baytrail SST DSP IPC support')
Signed-off-by Dan Carpenter <[email protected]>
sound/soc/intel/sst-baytrail-ipc.c +5 -5
index c12e194bbc6b..d0eaeee21be4 100644
@@ -796,7 +796,7 @@ int sst_byt_dsp_init(struct device *dev, struct sst_pdata *pdata)
 
 	err = msg_empty_list_init(byt);
 	if (err < 0)
-		goto list_err;
+		return -ENOMEM;
 
 	/* start the IPC message thread */
 	init_kthread_worker(&byt->kworker);

@@ -806,7 +806,7 @@ int sst_byt_dsp_init(struct device *dev, struct sst_pdata *pdata)
 	if (IS_ERR(byt->tx_thread)) {
 		err = PTR_ERR(byt->tx_thread);
 		dev_err(byt->dev, "error failed to create message TX task\n");
-		goto list_err;
+		goto err_free_msg;
 	}
 	init_kthread_work(&byt->kwork, sst_byt_ipc_tx_msgs);
 

@@ -816,7 +816,7 @@ int sst_byt_dsp_init(struct device *dev, struct sst_pdata *pdata)
 	byt->dsp = sst_dsp_new(dev, &byt_dev, pdata);
 	if (byt->dsp == NULL) {
 		err = -ENODEV;
-		goto list_err;
+		goto err_free_msg;
 	}
 
 	/* keep the DSP in reset state for base FW loading */

@@ -848,9 +848,9 @@ boot_err:
 	sst_fw_free(byt_sst_fw);
 fw_err:
 	sst_dsp_free(byt->dsp);
+err_free_msg:
 	kfree(byt->msg);
-list_err:
-	kfree(byt);
+
 	return err;
 }
 EXPORT_SYMBOL_GPL(sst_byt_dsp_init);
maintainer Acked-by on v1 1/1
#1 lore raw
Quoted 4 lines · Dan Carpenter

Calling "kfree(byt)" is a double free because that was allocated with devm_kzalloc(). There were a couple places which leak "byt->msg". That memory is allocated in msg_empty_list_init().

Thanks, we've just fixed this too but were not quicker than you for upstreaming ;)

Acked-by Liam Girdwood <[email protected]>
maintainer Applied
#2 lore raw
In reply to Dan Carpenter
Quoted 3 lines · Dan Carpenter

Calling "kfree(byt)" is a double free because that was allocated with devm_kzalloc(). There were a couple places which leak "byt->msg". That memory is allocated in msg_empty_list_init().

Applied, thanks.