github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-27 16:44:58 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ALSA: qc_audio_offload: avoid leaking xfer_buf allocation

Browse Source 
The info->xfer_buf_cpu member is set to a NULL value because the
allocation happens in a different function and is only assigned
to the function argument but never passed back.

Pass it by reference instead to have a handle that can actually be
freed by the final usb_free_coherent() call.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20250513123442.159936-3-arnd@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Arnd Bergmann 2025-05-13 14:34:41 +02:00 committed by Greg Kroah-Hartman
parent 485ae08592
commit 5c7ef50012
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
sound/usb/qcom/qc_audio_offload.c
View File

@ -1014,10 +1014,11 @@ static int enable_audio_stream(struct snd_usb_substream *subs,
* *
*/ */
static int uaudio_transfer_buffer_setup(struct snd_usb_substream *subs, static int uaudio_transfer_buffer_setup(struct snd_usb_substream *subs,
u8 *xfer_buf, u32 xfer_buf_len, void **xfer_buf_cpu, u32 xfer_buf_len,
struct mem_info_v01 *mem_info) struct mem_info_v01 *mem_info)
{ {
struct sg_table xfer_buf_sgt; struct sg_table xfer_buf_sgt;
void *xfer_buf;
phys_addr_t xfer_buf_pa; phys_addr_t xfer_buf_pa;
u32 len = xfer_buf_len; u32 len = xfer_buf_len;
bool dma_coherent; bool dma_coherent;
@ -1060,6 +1061,7 @@ static int uaudio_transfer_buffer_setup(struct snd_usb_substream *subs,
mem_info->dma = xfer_buf_pa; mem_info->dma = xfer_buf_pa;
mem_info->size = len; mem_info->size = len;
mem_info->iova = PREPEND_SID_TO_IOVA(iova, uaudio_qdev->data->sid); mem_info->iova = PREPEND_SID_TO_IOVA(iova, uaudio_qdev->data->sid);
*xfer_buf_cpu = xfer_buf;
sg_free_table(&xfer_buf_sgt); sg_free_table(&xfer_buf_sgt);
return 0; return 0;
@ -1340,7 +1342,7 @@ static int prepare_qmi_response(struct snd_usb_substream *subs,
struct q6usb_offload *data; struct q6usb_offload *data;
int pcm_dev_num; int pcm_dev_num;
int card_num; int card_num;
u8 *xfer_buf_cpu = NULL; void *xfer_buf_cpu;
int ret; int ret;
pcm_dev_num = (req_msg->usb_token & QMI_STREAM_REQ_DEV_NUM_MASK) >> 8; pcm_dev_num = (req_msg->usb_token & QMI_STREAM_REQ_DEV_NUM_MASK) >> 8;
@ -1409,7 +1411,7 @@ static int prepare_qmi_response(struct snd_usb_substream *subs,
resp->speed_info_valid = 1; resp->speed_info_valid = 1;
ret = uaudio_transfer_buffer_setup(subs, xfer_buf_cpu, req_msg->xfer_buff_size, ret = uaudio_transfer_buffer_setup(subs, &xfer_buf_cpu, req_msg->xfer_buff_size,
&resp->xhci_mem_info.xfer_buff); &resp->xhci_mem_info.xfer_buff);
if (ret < 0) { if (ret < 0) {
ret = -ENOMEM; ret = -ENOMEM;