lkml.org 
[lkml]   [2017]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.13 01/85] staging: bcm2835-audio: Fix memory corruption
    Date
    4.13-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Phil Elwell <phil@raspberrypi.org>

    commit c97d96b4e612c7dc1b37d7afc61b598a9a25994d upstream.

    The previous commit (0adbfd46) fixed a memory leak but also freed a
    block in the success case, causing a stale pointer to be used with
    potentially fatal results. Only free the vchi_instance block in the
    case that vchi_connect fails; once connected, the instance is
    retained for subsequent connections.

    Simplifying the code by removing a bunch of gotos and returning errors
    directly.

    Signed-off-by: Phil Elwell <phil@raspberrypi.org>
    Fixes: 0adbfd4694c2 ("staging: bcm2835-audio: fix memory leak in bcm2835_audio_open_connection()")
    Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c | 19 ++++--------
    1 file changed, 7 insertions(+), 12 deletions(-)

    --- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
    +++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c
    @@ -390,8 +390,7 @@ static int bcm2835_audio_open_connection
    __func__, instance);
    instance->alsa_stream = alsa_stream;
    alsa_stream->instance = instance;
    - ret = 0; // xxx todo -1;
    - goto err_free_mem;
    + return 0;
    }

    /* Initialize and create a VCHI connection */
    @@ -401,16 +400,15 @@ static int bcm2835_audio_open_connection
    LOG_ERR("%s: failed to initialise VCHI instance (ret=%d)\n",
    __func__, ret);

    - ret = -EIO;
    - goto err_free_mem;
    + return -EIO;
    }
    ret = vchi_connect(NULL, 0, vchi_instance);
    if (ret) {
    LOG_ERR("%s: failed to connect VCHI instance (ret=%d)\n",
    __func__, ret);

    - ret = -EIO;
    - goto err_free_mem;
    + kfree(vchi_instance);
    + return -EIO;
    }
    initted = 1;
    }
    @@ -421,19 +419,16 @@ static int bcm2835_audio_open_connection
    if (IS_ERR(instance)) {
    LOG_ERR("%s: failed to initialize audio service\n", __func__);

    - ret = PTR_ERR(instance);
    - goto err_free_mem;
    + /* vchi_instance is retained for use the next time. */
    + return PTR_ERR(instance);
    }

    instance->alsa_stream = alsa_stream;
    alsa_stream->instance = instance;

    LOG_DBG(" success !\n");
    - ret = 0;
    -err_free_mem:
    - kfree(vchi_instance);

    - return ret;
    + return 0;
    }

    int bcm2835_audio_open(struct bcm2835_alsa_stream *alsa_stream)

    \
     
     \ /
      Last update: 2017-10-24 15:33    [W:3.828 / U:1.276 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site