Commit 769fab2a41da4bd3c59eee38f47d6d5405738fe0

Authored by Jesper Juhl
Committed by Takashi Iwai
1 parent 4d20bb1d5f

ALSA: Fix memory leak on error in snd_compr_set_params()

If copy_from_user() does not return 0 we'll leak the memory we
allocated for 'params' when that variable goes out of scope.

Also a small CodingStyle cleanup: Use braces on both branches of
if/else when one branch needs it.

Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Acked-by: Vinod Koul <vinod.koul@linux.intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Showing 1 changed file with 8 additions and 5 deletions Side-by-side Diff

sound/core/compress_offload.c
... ... @@ -441,19 +441,22 @@
441 441 params = kmalloc(sizeof(*params), GFP_KERNEL);
442 442 if (!params)
443 443 return -ENOMEM;
444   - if (copy_from_user(params, (void __user *)arg, sizeof(*params)))
445   - return -EFAULT;
  444 + if (copy_from_user(params, (void __user *)arg, sizeof(*params))) {
  445 + retval = -EFAULT;
  446 + goto out;
  447 + }
446 448 retval = snd_compr_allocate_buffer(stream, params);
447 449 if (retval) {
448   - kfree(params);
449   - return -ENOMEM;
  450 + retval = -ENOMEM;
  451 + goto out;
450 452 }
451 453 retval = stream->ops->set_params(stream, params);
452 454 if (retval)
453 455 goto out;
454 456 stream->runtime->state = SNDRV_PCM_STATE_SETUP;
455   - } else
  457 + } else {
456 458 return -EPERM;
  459 + }
457 460 out:
458 461 kfree(params);
459 462 return retval;