lkml.org 
[lkml]   [2024]   [May]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] line6: add midibuf init failure handling in line6_init_midi()
On Thu, 16 May 2024 19:47:38 +0200,
yskelg@gmail.com wrote:
>
> From: Yunseong Kim <yskelg@gmail.com>
>
> This patch fixes potential memory allocation failures in the
> line6_midibuf_init(). If either midibuf_in, midibuf_out allocation
> line6_midibuf_init call failed, the allocated memory for line6midi
> might have been leaked.
>
> This patch introduces an error handling label and uses goto to jump there
> in case of allocation failures. A kfree call is added to release any
> partially allocated memory before returning the error code.
>
> Signed-off-by: Yunseong Kim <yskelg@gmail.com>

The allocated object is already freed by snd_line6_midi_free() that is
called via rawmidi private_free at its destruction. So your change
would lead to a double-free.


thanks,

Takashi

> ---
> sound/usb/line6/midi.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/sound/usb/line6/midi.c b/sound/usb/line6/midi.c
> index 0838632c788e..abcf58f46673 100644
> --- a/sound/usb/line6/midi.c
> +++ b/sound/usb/line6/midi.c
> @@ -283,13 +283,18 @@ int line6_init_midi(struct usb_line6 *line6)
>
> err = line6_midibuf_init(&line6midi->midibuf_in, MIDI_BUFFER_SIZE, 0);
> if (err < 0)
> - return err;
> + goto error;
>
> err = line6_midibuf_init(&line6midi->midibuf_out, MIDI_BUFFER_SIZE, 1);
> if (err < 0)
> - return err;
> + goto error;
>
> line6->line6midi = line6midi;
> return 0;
> +
> +error:
> + kfree(line6midi);
> + return err;
> +
> }
> EXPORT_SYMBOL_GPL(line6_init_midi);
> --
> 2.34.1
>

\
 
 \ /
  Last update: 2024-05-27 18:30    [W:0.141 / U:1.040 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site