Messages in this thread | | | Date | Fri, 17 May 2024 10:32:13 +0200 | From | Takashi Iwai <> | Subject | Re: [PATCH] line6: add midibuf init failure handling in line6_init_midi() |
| |
On Thu, 16 May 2024 19:47:38 +0200, yskelg@gmail.com wrote: > > From: Yunseong Kim <yskelg@gmail.com> > > This patch fixes potential memory allocation failures in the > line6_midibuf_init(). If either midibuf_in, midibuf_out allocation > line6_midibuf_init call failed, the allocated memory for line6midi > might have been leaked. > > This patch introduces an error handling label and uses goto to jump there > in case of allocation failures. A kfree call is added to release any > partially allocated memory before returning the error code. > > Signed-off-by: Yunseong Kim <yskelg@gmail.com>
The allocated object is already freed by snd_line6_midi_free() that is called via rawmidi private_free at its destruction. So your change would lead to a double-free.
thanks,
Takashi
> --- > sound/usb/line6/midi.c | 9 +++++++-- > 1 file changed, 7 insertions(+), 2 deletions(-) > > diff --git a/sound/usb/line6/midi.c b/sound/usb/line6/midi.c > index 0838632c788e..abcf58f46673 100644 > --- a/sound/usb/line6/midi.c > +++ b/sound/usb/line6/midi.c > @@ -283,13 +283,18 @@ int line6_init_midi(struct usb_line6 *line6) > > err = line6_midibuf_init(&line6midi->midibuf_in, MIDI_BUFFER_SIZE, 0); > if (err < 0) > - return err; > + goto error; > > err = line6_midibuf_init(&line6midi->midibuf_out, MIDI_BUFFER_SIZE, 1); > if (err < 0) > - return err; > + goto error; > > line6->line6midi = line6midi; > return 0; > + > +error: > + kfree(line6midi); > + return err; > + > } > EXPORT_SYMBOL_GPL(line6_init_midi); > -- > 2.34.1 >
| |