| Message ID | 20140305111157.GD16926@elgon.mountain (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 9202c377390f2708dece910f2e066a6308a38abc |
| Headers | show |
On Wed, 2014-03-05 at 14:11 +0300, Dan Carpenter wrote: > Calling "kfree(byt)" is a double free because that was allocated with > devm_kzalloc(). There were a couple places which leak "byt->msg". That > memory is allocated in msg_empty_list_init(). > Thanks, we've just fixed this too but were not quicker than you for upstreaming ;) Acked-by: Liam Girdwood <liam.r.girdwood@linux.intel.com>
On Wed, Mar 05, 2014 at 02:11:57PM +0300, Dan Carpenter wrote: > Calling "kfree(byt)" is a double free because that was allocated with > devm_kzalloc(). There were a couple places which leak "byt->msg". That > memory is allocated in msg_empty_list_init(). Applied, thanks.
diff --git a/sound/soc/intel/sst-baytrail-ipc.c b/sound/soc/intel/sst-baytrail-ipc.c index c12e194bbc6b..d0eaeee21be4 100644 --- a/sound/soc/intel/sst-baytrail-ipc.c +++ b/sound/soc/intel/sst-baytrail-ipc.c @@ -796,7 +796,7 @@ int sst_byt_dsp_init(struct device *dev, struct sst_pdata *pdata) err = msg_empty_list_init(byt); if (err < 0) - goto list_err; + return -ENOMEM; /* start the IPC message thread */ init_kthread_worker(&byt->kworker); @@ -806,7 +806,7 @@ int sst_byt_dsp_init(struct device *dev, struct sst_pdata *pdata) if (IS_ERR(byt->tx_thread)) { err = PTR_ERR(byt->tx_thread); dev_err(byt->dev, "error failed to create message TX task\n"); - goto list_err; + goto err_free_msg; } init_kthread_work(&byt->kwork, sst_byt_ipc_tx_msgs); @@ -816,7 +816,7 @@ int sst_byt_dsp_init(struct device *dev, struct sst_pdata *pdata) byt->dsp = sst_dsp_new(dev, &byt_dev, pdata); if (byt->dsp == NULL) { err = -ENODEV; - goto list_err; + goto err_free_msg; } /* keep the DSP in reset state for base FW loading */ @@ -848,9 +848,9 @@ boot_err: sst_fw_free(byt_sst_fw); fw_err: sst_dsp_free(byt->dsp); +err_free_msg: kfree(byt->msg); -list_err: - kfree(byt); + return err; } EXPORT_SYMBOL_GPL(sst_byt_dsp_init);
Calling "kfree(byt)" is a double free because that was allocated with devm_kzalloc(). There were a couple places which leak "byt->msg". That memory is allocated in msg_empty_list_init(). Fixes: f7d01fd6754c ('ASoC: Intel: Add Intel Baytrail SST DSP IPC support') Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>