UAC3 channel map is created during interface parsing, and in some cases was not freed in failure paths.

Reported-by: Dan Carpenter dan.carpenter@oracle.com Signed-off-by: Ruslan Bilovol ruslan.bilovol@gmail.com --- sound/usb/stream.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/sound/usb/stream.c b/sound/usb/stream.c index bce3152..d16e1c2 100644 --- a/sound/usb/stream.c +++ b/sound/usb/stream.c @@ -982,13 +982,16 @@ static int parse_uac_endpoint_attributes(struct snd_usb_audio *chip,

dev_err(&dev->dev, "%u:%d : bogus bTerminalLink %d\n", iface_no, altno, as->bTerminalLink); + kfree(chmap); return NULL;

found_clock: fp = audio_format_alloc_init(chip, alts, UAC_VERSION_3, iface_no, altset_idx, altno, num_channels, clock); - if (!fp) + if (!fp) { + kfree(chmap); return ERR_PTR(-ENOMEM); + }

fp->chmap = chmap;

@@ -1009,6 +1012,7 @@ static int parse_uac_endpoint_attributes(struct snd_usb_audio *chip, iface_no); /* ok, let's parse further... */ if (snd_usb_parse_audio_format_v3(chip, fp, as, stream) < 0) { + kfree(fp->chmap); kfree(fp->rate_table); kfree(fp); return NULL;