releases/4.4.181/alsa-usb-audio-fix-a-memory-leak-bug.patch

   1 From cb5173594d50c72b7bfa14113dfc5084b4d2f726 Mon Sep 17 00:00:00 2001
   2 From: Wenwen Wang <wang6495@umn.edu>
   3 Date: Sat, 27 Apr 2019 01:06:46 -0500
   4 Subject: ALSA: usb-audio: Fix a memory leak bug
   5
   6 From: Wenwen Wang <wang6495@umn.edu>
   7
   8 commit cb5173594d50c72b7bfa14113dfc5084b4d2f726 upstream.
   9
  10 In parse_audio_selector_unit(), the string array 'namelist' is allocated
  11 through kmalloc_array(), and each string pointer in this array, i.e.,
  12 'namelist[]', is allocated through kmalloc() in the following for loop.
  13 Then, a control instance 'kctl' is created by invoking snd_ctl_new1(). If
  14 an error occurs during the creation process, the string array 'namelist',
  15 including all string pointers in the array 'namelist[]', should be freed,
  16 before the error code ENOMEM is returned. However, the current code does
  17 not free 'namelist[]', resulting in memory leaks.
  18
  19 To fix the above issue, free all string pointers 'namelist[]' in a loop.
  20
  21 Signed-off-by: Wenwen Wang <wang6495@umn.edu>
  22 Cc: <stable@vger.kernel.org>
  23 Signed-off-by: Takashi Iwai <tiwai@suse.de>
  24 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  25
  26 ---
  27  sound/usb/mixer.c |    2 ++
  28  1 file changed, 2 insertions(+)
  29
  30 --- a/sound/usb/mixer.c
  31 +++ b/sound/usb/mixer.c
  32 @@ -2112,6 +2112,8 @@ static int parse_audio_selector_unit(str
  33         kctl = snd_ctl_new1(&mixer_selectunit_ctl, cval);
  34         if (! kctl) {
  35                 usb_audio_err(state->chip, "cannot malloc kcontrol\n");
  36 +               for (i = 0; i < desc->bNrInPins; i++)
  37 +                       kfree(namelist[i]);
  38                 kfree(namelist);
  39                 kfree(cval);
  40                 return -ENOMEM;