Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 460102

Summary: kernel: alsa: asoc: fix double free and memory leak in many codec drivers [mrg-1]
Product: Red Hat Enterprise MRG Reporter: Eugene Teo (Security Response) <eteo>
Component: realtime-kernelAssignee: Red Hat Real Time Maintenance <rt-maint>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: 1.1CC: bhu, davids, lgoncalv, williams
Target Milestone: 1.1   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-01-22 10:44:47 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 460103    
Attachments:
Description Flags
Upstream patch for this issue none

Description Eugene Teo (Security Response) 2008-08-26 07:44:14 UTC 
Description of problem:
Many SoC audio codec drivers have improper freeing of memory in error paths.

* codec is allocated in the platform device probe function, but is not freed there in case of error. Instead it is freed in the i2c device probe function's error path. However the success or failure of both functions is not linked, so this could result in a double free (if the platform device is successfully probed, the i2c device probing fails and then the platform driver is unregistered.)

* codec->private_data is allocated in many platform device probe functions but not freed in their error paths.
Comment 1 Eugene Teo (Security Response) 2008-08-26 07:44:56 UTC 
Proposed upstream patch:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3051e41ab7daaa59d4564f20b25dcb8c03f35f2b
Comment 2 Eugene Teo (Security Response) 2008-08-26 07:45:45 UTC 
Created attachment 314967 [details]
Upstream patch for this issue
Comment 3 Eugene Teo (Security Response) 2008-08-26 07:46:43 UTC 
We need to backport the wm87{31,50,53}.c bits to the realtime kernel.
Comment 4 Luis Claudio R. Goncalves 2008-10-29 00:02:21 UTC 
Patch added to -90
Comment 6 David Sommerseth 2008-11-19 16:48:18 UTC 
Found upstream commit 3051e41ab7daaa59d4564f20b25dcb8c03f35f2b in mrg-rt.git as commit 7c9f16c4853ba6c2774f15291c6594a0ceba5315

mrg-rt.git commit is found included in the mrg-rt.git branch mrg-rt-2.6.24.7-93 for the wm87{31,50,53} drivers.
Comment 8 errata-xmlrpc 2009-01-22 10:44:47 UTC 
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2009-0009.html