ASoC: Baytrail: fix error handling in sst_byt_dsp_init()
diff mbox

Message ID 20140305111157.GD16926@elgon.mountain
State Accepted
Commit 9202c377390f2708dece910f2e066a6308a38abc
Headers show

Commit Message

Dan Carpenter March 5, 2014, 11:11 a.m. UTC
Calling "kfree(byt)" is a double free because that was allocated with
devm_kzalloc().  There were a couple places which leak "byt->msg".  That
memory is allocated in msg_empty_list_init().

Fixes: f7d01fd6754c ('ASoC: Intel: Add Intel Baytrail SST DSP IPC support')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Comments

Liam Girdwood March 5, 2014, 7:18 p.m. UTC | #1
On Wed, 2014-03-05 at 14:11 +0300, Dan Carpenter wrote:
> Calling "kfree(byt)" is a double free because that was allocated with
> devm_kzalloc().  There were a couple places which leak "byt->msg".  That
> memory is allocated in msg_empty_list_init().
> 

Thanks, we've just fixed this too but were not quicker than you for
upstreaming ;)

Acked-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
Mark Brown March 6, 2014, 4:22 a.m. UTC | #2
On Wed, Mar 05, 2014 at 02:11:57PM +0300, Dan Carpenter wrote:
> Calling "kfree(byt)" is a double free because that was allocated with
> devm_kzalloc().  There were a couple places which leak "byt->msg".  That
> memory is allocated in msg_empty_list_init().

Applied, thanks.

Patch
diff mbox

diff --git a/sound/soc/intel/sst-baytrail-ipc.c b/sound/soc/intel/sst-baytrail-ipc.c
index c12e194bbc6b..d0eaeee21be4 100644
--- a/sound/soc/intel/sst-baytrail-ipc.c
+++ b/sound/soc/intel/sst-baytrail-ipc.c
@@ -796,7 +796,7 @@  int sst_byt_dsp_init(struct device *dev, struct sst_pdata *pdata)
 
 	err = msg_empty_list_init(byt);
 	if (err < 0)
-		goto list_err;
+		return -ENOMEM;
 
 	/* start the IPC message thread */
 	init_kthread_worker(&byt->kworker);
@@ -806,7 +806,7 @@  int sst_byt_dsp_init(struct device *dev, struct sst_pdata *pdata)
 	if (IS_ERR(byt->tx_thread)) {
 		err = PTR_ERR(byt->tx_thread);
 		dev_err(byt->dev, "error failed to create message TX task\n");
-		goto list_err;
+		goto err_free_msg;
 	}
 	init_kthread_work(&byt->kwork, sst_byt_ipc_tx_msgs);
 
@@ -816,7 +816,7 @@  int sst_byt_dsp_init(struct device *dev, struct sst_pdata *pdata)
 	byt->dsp = sst_dsp_new(dev, &byt_dev, pdata);
 	if (byt->dsp == NULL) {
 		err = -ENODEV;
-		goto list_err;
+		goto err_free_msg;
 	}
 
 	/* keep the DSP in reset state for base FW loading */
@@ -848,9 +848,9 @@  boot_err:
 	sst_fw_free(byt_sst_fw);
 fw_err:
 	sst_dsp_free(byt->dsp);
+err_free_msg:
 	kfree(byt->msg);
-list_err:
-	kfree(byt);
+
 	return err;
 }
 EXPORT_SYMBOL_GPL(sst_byt_dsp_init);