[PATCH v2] ALSA: usb-audio: qcom: Free QMI handle

[PATCH v2] ALSA: usb-audio: qcom: Free QMI handle

[raoxu]

From: Xu Rao <raoxu@uniontech.com>

qc_usb_audio_probe() allocates svc->uaudio_svc_hdl separately from the
uaudio_qmi_svc object.

qmi_handle_release() releases the resources owned by an initialized QMI
handle, but does not free the memory containing the struct qmi_handle
itself. The probe error path and the remove path currently release the
handle and then free svc, losing the last pointer to the separately
allocated handle.

This leaks one struct qmi_handle on each affected probe unwind and on
each successful probe/remove cycle.

Free the handle after qmi_handle_release() in both paths.

Signed-off-by: Xu Rao <raoxu@uniontech.com>
---
Changes in v2:
- Fix the subject prefix for a single patch.

 sound/usb/qcom/qc_audio_offload.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/usb/qcom/qc_audio_offload.c b/sound/usb/qcom/qc_audio_offload.c
index 3a586fd..e4bfd43 100644
--- a/sound/usb/qcom/qc_audio_offload.c
+++ b/sound/usb/qcom/qc_audio_offload.c
@@ -1988,6 +1988,7 @@ static int qc_usb_audio_probe(struct auxiliary_device *auxdev,
 release_qmi:
 	qc_usb_audio_cleanup_qmi_dev();
 	qmi_handle_release(svc->uaudio_svc_hdl);
+	kfree(svc->uaudio_svc_hdl);
 free_svc:
 	kfree(svc);

@@ -2012,6 +2013,7 @@ static void qc_usb_audio_remove(struct auxiliary_device *auxdev)
 	qc_usb_audio_cleanup_qmi_dev();

 	qmi_handle_release(svc->uaudio_svc_hdl);
+	kfree(svc->uaudio_svc_hdl);
 	kfree(svc);
 	uaudio_svc = NULL;
 }
--
2.47.3

Re: [PATCH v2] ALSA: usb-audio: qcom: Free QMI handle

[Takashi Iwai]

On Tue, 23 Jun 2026 09:13:08 +0200,
raoxu wrote:
> 
> From: Xu Rao <raoxu@uniontech.com>
> 
> qc_usb_audio_probe() allocates svc->uaudio_svc_hdl separately from the
> uaudio_qmi_svc object.
> 
> qmi_handle_release() releases the resources owned by an initialized QMI
> handle, but does not free the memory containing the struct qmi_handle
> itself. The probe error path and the remove path currently release the
> handle and then free svc, losing the last pointer to the separately
> allocated handle.
> 
> This leaks one struct qmi_handle on each affected probe unwind and on
> each successful probe/remove cycle.
> 
> Free the handle after qmi_handle_release() in both paths.
> 
> Signed-off-by: Xu Rao <raoxu@uniontech.com>
> ---
> Changes in v2:
> - Fix the subject prefix for a single patch.

Applied now.  Thanks.


Takashi