Skip to content
  • Takashi Iwai's avatar
    ALSA: usb-audio: Fix memory leak and corruption in mixer_us16x08.c · e2810d76
    Takashi Iwai authored
    There are a few places leaking memory and doing double-free in
    mixer_us16x08.c.
    
    The driver allocates a usb_mixer_elem_info object at each
    add_new_ctl() call.  This has to be freed via kctl->private_free, but
    currently this is done properly only for some controls.
    
    Also, the driver allocates three external objects (comp_store,
    eq_store, meter_store), and these are referred in elem->private_data
    (it's not kctl->private_data).  And these have to be released, but
    there are none doing it.  Moreover, these extra objects have to be
    released only once.  Thus the release should be done only by the first
    kctl element that refers to it.
    
    For fixing these, we call either snd_usb_mixer_elem_free() (only for
    kctl->private_data) or elem_private_free() (for both
    kctl->private_data and elem->private_data) via kctl->private_free
    appropriately.
    
    Last but not least, snd_us16x08_controls_create() may return in the
    middle without releasing the allocated *_store objects due to an
    error.  For fixing this, we shuffle the allocation code so that it's
    called just before its reference.
    
    Fixes: d2bb390a
    
     ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk")
    Reported-by: default avatarTakashi Sakamoto <o-takashi@sakamocchi.jp>
    Reviewed-by: default avatarTakashi Sakamoto <o-takashi@sakamocchi.jp>
    Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
    e2810d76