Skip to content

Commit 0accedd

Browse files
committed
math: fft: fix error path in mod_fft_multi_plan_new()
The error path of mod_fft_multi_plan_new() had two related bugs. With num_ffts == 1 the temporary input buffer aliases the caller-provided inb, but the err_free_buffer label freed plan->tmp_i32[0] unconditionally, which would have released the caller's buffer. With num_ffts == 3, a failure in the second or third fft_plan_common_new() call only freed the shared scratch buffer and the bit-reverse table, leaking the previously allocated fft_plan entries. Collapse all error labels into a single err: that calls mod_fft_multi_plan_free(). That helper already walks fft_plan[] (NULL slots from the initial mod_zalloc() are no-ops in mod_free()) and only frees tmp_i32[0] when num_ffts > 1, so both issues are handled in one place. Signed-off-by: Seppo Ingalsuo <seppo.ingalsuo@linux.intel.com>
1 parent 462cfb5 commit 0accedd

1 file changed

Lines changed: 8 additions & 9 deletions

File tree

src/math/fft/fft_multi.c

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ struct fft_multi_plan *mod_fft_multi_plan_new(struct processing_module *mod, voi
7575
plan->tmp_i32[0] = mod_balloc(mod, tmp_size);
7676
if (!plan->tmp_i32[0]) {
7777
comp_cl_err(mod->dev, "Failed to allocate FFT buffers");
78-
goto err_free_bit_reverse;
78+
goto err;
7979
}
8080

8181
/* Set up buffers */
@@ -95,7 +95,7 @@ struct fft_multi_plan *mod_fft_multi_plan_new(struct processing_module *mod, voi
9595
plan->tmp_o32[i],
9696
plan->fft_size, 32);
9797
if (!plan->fft_plan[i])
98-
goto err_free_buffer;
98+
goto err;
9999

100100
plan->fft_plan[i]->bit_reverse_idx = plan->bit_reverse_idx;
101101
}
@@ -110,14 +110,13 @@ struct fft_multi_plan *mod_fft_multi_plan_new(struct processing_module *mod, voi
110110
plan->fft_plan[0]->len);
111111
return plan;
112112

113-
err_free_buffer:
114-
mod_free(mod, plan->tmp_i32[0]);
115-
116-
err_free_bit_reverse:
117-
mod_free(mod, plan->bit_reverse_idx);
118-
119113
err:
120-
mod_free(mod, plan);
114+
/* mod_fft_multi_plan_free() handles partial state safely:
115+
* - fft_plan[i] entries left NULL by mod_zalloc are skipped by mod_free,
116+
* - tmp_i32[0] is freed only when num_ffts > 1, so it does not free
117+
* the caller-provided inb in the single-FFT case.
118+
*/
119+
mod_fft_multi_plan_free(mod, plan);
121120
return NULL;
122121
}
123122

0 commit comments

Comments
 (0)