On Thu, 15 Jul 2021 02:56:25 +0200, Salah Triki wrote:
Free allocated urbs on failure in order to prevent memory leaks.
Signed-off-by: Salah Triki salah.triki@gmail.com
This will lead to double-free. The resources are freed in the destructor of PCM component, line6_cleanup_pcm().
Takashi
sound/usb/line6/capture.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-)
diff --git a/sound/usb/line6/capture.c b/sound/usb/line6/capture.c index 970c9bdce0b2..345b75ede5d5 100644 --- a/sound/usb/line6/capture.c +++ b/sound/usb/line6/capture.c @@ -258,6 +258,7 @@ int line6_create_audio_in_urbs(struct snd_line6_pcm *line6pcm) { struct usb_line6 *line6 = line6pcm->line6; int i;
int ret;
line6pcm->in.urbs = kcalloc(line6->iso_buffers, sizeof(struct urb *), GFP_KERNEL);
@@ -272,8 +273,10 @@ int line6_create_audio_in_urbs(struct snd_line6_pcm *line6pcm) urb = line6pcm->in.urbs[i] = usb_alloc_urb(LINE6_ISO_PACKETS, GFP_KERNEL);
if (urb == NULL)return -ENOMEM;
if (urb == NULL) {ret = -ENOMEM;goto enomem;}urb->dev = line6->usbdev; urb->pipe =
@@ -286,9 +289,20 @@ int line6_create_audio_in_urbs(struct snd_line6_pcm *line6pcm) urb->interval = LINE6_ISO_INTERVAL; urb->error_count = 0; urb->complete = audio_in_callback;
if (usb_urb_ep_type_check(urb))return -EINVAL;
if (usb_urb_ep_type_check(urb)) {ret = -EINVAL;goto einval;}}
return 0;
+enomem:
- i--;
+einval:
- while (i >= 0)
usb_free_urb(line6pcm->in.urbs[i--]);- return ret;
}
2.25.1