superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ASoC: sma1307: fix double free of devm_kzalloc() memory 

A previous change added NULL checks and cleanup for allocation
failures in sma1307_setting_loaded().

However, the cleanup for mode_set entries is wrong. Those entries are
allocated with devm_kzalloc(), so they are device-managed resources and
must not be freed with kfree(). Manually freeing them in the error path
can lead to a double free when devres later releases the same memory.

Drop the manual kfree() loop and let devres handle the cleanup.

Fixes: 0ec6bd1670 ("ASoC: sma1307: Add NULL check in sma1307_setting_loaded()")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260313040611.391479-1-lgs201920130244@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
master
Guangshuo Li 2026-03-13 12:06:11 +08:00 committed by Mark Brown
parent f338e77383
commit fe757092d2
No known key found for this signature in database
GPG Key ID: 24D68B725D5487D0
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sound/soc/codecs/sma1307.c
View File

@ -1759,8 +1759,10 @@ static void sma1307_setting_loaded(struct sma1307_priv *sma1307, const char *fil
sma1307->set.mode_size * 2 * sizeof(int),
GFP_KERNEL);
if (!sma1307->set.mode_set[i]) {
for (int j = 0; j < i; j++)
kfree(sma1307->set.mode_set[j]);
for (int j = 0; j < i; j++) {
devm_kfree(sma1307->dev, sma1307->set.mode_set[j]);
sma1307->set.mode_set[j] = NULL;
}
sma1307->set.status = false;
return;
}