Messages in this thread | | | Date | Sat, 18 May 2024 14:58:08 +0900 | Subject | Re: [PATCH] line6: add midibuf init failure handling in line6_init_midi() | From | Yunseong Kim <> |
| |
On 5/18/24 2:44 오전, Bjorn Helgaas wrote: > On Fri, May 17, 2024 at 10:32:13AM +0200, Takashi Iwai wrote: >> On Thu, 16 May 2024 19:47:38 +0200, >> yskelg@gmail.com wrote: >>> >>> From: Yunseong Kim <yskelg@gmail.com> >>> >>> This patch fixes potential memory allocation failures in the >>> line6_midibuf_init(). If either midibuf_in, midibuf_out allocation >>> line6_midibuf_init call failed, the allocated memory for line6midi >>> might have been leaked. >>> >>> This patch introduces an error handling label and uses goto to jump there >>> in case of allocation failures. A kfree call is added to release any >>> partially allocated memory before returning the error code. >>> >>> Signed-off-by: Yunseong Kim <yskelg@gmail.com> >> >> The allocated object is already freed by snd_line6_midi_free() that is >> called via rawmidi private_free at its destruction. So your change >> would lead to a double-free. > > I stand corrected, sorry that I missed that! > > That said, it seems unreasonably hard to verify this path to > snd_line6_midi_free(). > > Sorry for misleading you, Yunseong.
Thank you Bjorn for your detailed advice. I will take them to heart and work on them in the future.
Warm Regards, Yunseong Kim
>>> --- >>> sound/usb/line6/midi.c | 9 +++++++-- >>> 1 file changed, 7 insertions(+), 2 deletions(-) >>> >>> diff --git a/sound/usb/line6/midi.c b/sound/usb/line6/midi.c >>> index 0838632c788e..abcf58f46673 100644 >>> --- a/sound/usb/line6/midi.c >>> +++ b/sound/usb/line6/midi.c >>> @@ -283,13 +283,18 @@ int line6_init_midi(struct usb_line6 *line6) >>> >>> err = line6_midibuf_init(&line6midi->midibuf_in, MIDI_BUFFER_SIZE, 0); >>> if (err < 0) >>> - return err; >>> + goto error; >>> >>> err = line6_midibuf_init(&line6midi->midibuf_out, MIDI_BUFFER_SIZE, 1); >>> if (err < 0) >>> - return err; >>> + goto error; >>> >>> line6->line6midi = line6midi; >>> return 0; >>> + >>> +error: >>> + kfree(line6midi); >>> + return err; >>> + >>> } >>> EXPORT_SYMBOL_GPL(line6_init_midi); >>> -- >>> 2.34.1 >>>
| |