ALSA: usb-audio: Fix a memory leak bug

BugLink: https://bugs.launchpad.net/bugs/1838576
commit cb5173594d50c72b7bfa14113dfc5084b4d2f726 upstream.

In parse_audio_selector_unit(), the string array 'namelist' is allocated
through kmalloc_array(), and each string pointer in this array, i.e.,
'namelist[]', is allocated through kmalloc() in the following for loop.
Then, a control instance 'kctl' is created by invoking snd_ctl_new1(). If
an error occurs during the creation process, the string array 'namelist',
including all string pointers in the array 'namelist[]', should be freed,
before the error code ENOMEM is returned. However, the current code does
not free 'namelist[]', resulting in memory leaks.

To fix the above issue, free all string pointers 'namelist[]' in a loop.

Signed-off-by: Wenwen Wang <wang6495@umn.edu>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 1f58a0eeda3abdb0888887d0b640dbdc0c83fec3..ee6871ebd93619117293d65e1d8c73ec62dda3b5 100644 (file)
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2184,6 +2184,8 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid,
        kctl = snd_ctl_new1(&mixer_selectunit_ctl, cval);
        if (! kctl) {
                usb_audio_err(state->chip, "cannot malloc kcontrol\n");
+               for (i = 0; i < desc->bNrInPins; i++)
+                       kfree(namelist[i]);
                kfree(namelist);
                kfree(cval);
                return -ENOMEM;