From: Arnd Bergmann Date: Tue, 13 May 2025 12:34:41 +0000 (+0200) Subject: ALSA: qc_audio_offload: avoid leaking xfer_buf allocation X-Git-Tag: v6.16-rc1~28^2~11 X-Git-Url: https://git.kernel.dk/?a=commitdiff_plain;h=5c7ef5001292d70d09d90bc2251f7d869b9d135c;p=linux-block.git ALSA: qc_audio_offload: avoid leaking xfer_buf allocation The info->xfer_buf_cpu member is set to a NULL value because the allocation happens in a different function and is only assigned to the function argument but never passed back. Pass it by reference instead to have a handle that can actually be freed by the final usb_free_coherent() call. Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250513123442.159936-3-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman --- diff --git a/sound/usb/qcom/qc_audio_offload.c b/sound/usb/qcom/qc_audio_offload.c index 613e64f706ba..b5f845ade6f3 100644 --- a/sound/usb/qcom/qc_audio_offload.c +++ b/sound/usb/qcom/qc_audio_offload.c @@ -1014,10 +1014,11 @@ put_suspend: * */ static int uaudio_transfer_buffer_setup(struct snd_usb_substream *subs, - u8 *xfer_buf, u32 xfer_buf_len, + void **xfer_buf_cpu, u32 xfer_buf_len, struct mem_info_v01 *mem_info) { struct sg_table xfer_buf_sgt; + void *xfer_buf; phys_addr_t xfer_buf_pa; u32 len = xfer_buf_len; bool dma_coherent; @@ -1060,6 +1061,7 @@ static int uaudio_transfer_buffer_setup(struct snd_usb_substream *subs, mem_info->dma = xfer_buf_pa; mem_info->size = len; mem_info->iova = PREPEND_SID_TO_IOVA(iova, uaudio_qdev->data->sid); + *xfer_buf_cpu = xfer_buf; sg_free_table(&xfer_buf_sgt); return 0; @@ -1340,7 +1342,7 @@ static int prepare_qmi_response(struct snd_usb_substream *subs, struct q6usb_offload *data; int pcm_dev_num; int card_num; - u8 *xfer_buf_cpu = NULL; + void *xfer_buf_cpu; int ret; pcm_dev_num = (req_msg->usb_token & QMI_STREAM_REQ_DEV_NUM_MASK) >> 8; @@ -1409,7 +1411,7 @@ static int prepare_qmi_response(struct snd_usb_substream *subs, resp->speed_info_valid = 1; - ret = uaudio_transfer_buffer_setup(subs, xfer_buf_cpu, req_msg->xfer_buff_size, + ret = uaudio_transfer_buffer_setup(subs, &xfer_buf_cpu, req_msg->xfer_buff_size, &resp->xhci_mem_info.xfer_buff); if (ret < 0) { ret = -ENOMEM;