Bug 460102 - kernel: alsa: asoc: fix double free and memory leak in many codec drivers [mrg-1]
kernel: alsa: asoc: fix double free and memory leak in many codec drivers [mr...
Product: Red Hat Enterprise MRG
Classification: Red Hat
Component: realtime-kernel (Show other bugs)
All Linux
medium Severity medium
: 1.1
: ---
Assigned To: Red Hat Real Time Maintenance
Depends On:
Blocks: 460103
  Show dependency treegraph
Reported: 2008-08-26 03:44 EDT by Eugene Teo (Security Response)
Modified: 2009-01-22 05:44 EST (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2009-01-22 05:44:47 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Upstream patch for this issue (8.38 KB, patch)
2008-08-26 03:45 EDT, Eugene Teo (Security Response)
no flags Details | Diff

  None (edit)
Description Eugene Teo (Security Response) 2008-08-26 03:44:14 EDT
Description of problem:
Many SoC audio codec drivers have improper freeing of memory in error paths.

* codec is allocated in the platform device probe function, but is not freed there in case of error. Instead it is freed in the i2c device probe function's error path. However the success or failure of both functions is not linked, so this could result in a double free (if the platform device is successfully probed, the i2c device probing fails and then the platform driver is unregistered.)

* codec->private_data is allocated in many platform device probe functions but not freed in their error paths.
Comment 2 Eugene Teo (Security Response) 2008-08-26 03:45:45 EDT
Created attachment 314967 [details]
Upstream patch for this issue
Comment 3 Eugene Teo (Security Response) 2008-08-26 03:46:43 EDT
We need to backport the wm87{31,50,53}.c bits to the realtime kernel.
Comment 4 Luis Claudio R. Goncalves 2008-10-28 20:02:21 EDT
Patch added to -90
Comment 6 David Sommerseth 2008-11-19 11:48:18 EST
Found upstream commit 3051e41ab7daaa59d4564f20b25dcb8c03f35f2b in mrg-rt.git as commit 7c9f16c4853ba6c2774f15291c6594a0ceba5315

mrg-rt.git commit is found included in the mrg-rt.git branch mrg-rt- for the wm87{31,50,53} drivers.
Comment 8 errata-xmlrpc 2009-01-22 05:44:47 EST
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.