math: fft: fix error path in mod_fft_multi_plan_new()#10914
Open
singalsu wants to merge 1 commit into
Open
Conversation
The error path of mod_fft_multi_plan_new() had two related bugs. With num_ffts == 1 the temporary input buffer aliases the caller-provided inb, but the err_free_buffer label freed plan->tmp_i32[0] unconditionally, which would have released the caller's buffer. With num_ffts == 3, a failure in the second or third fft_plan_common_new() call only freed the shared scratch buffer and the bit-reverse table, leaking the previously allocated fft_plan entries. Collapse all error labels into a single err: that calls mod_fft_multi_plan_free(). That helper already walks fft_plan[] (NULL slots from the initial mod_zalloc() are no-ops in mod_free()) and only frees tmp_i32[0] when num_ffts > 1, so both issues are handled in one place. Signed-off-by: Seppo Ingalsuo <seppo.ingalsuo@linux.intel.com>
singalsu
requested review from
dbaluta,
kv2019i,
lbetlej,
lgirdwood,
mmaka1 and
plbossart
as code owners
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes cleanup logic in mod_fft_multi_plan_new() so error handling is correct for both the single-FFT (power-of-2) and 3-FFT (size divisible by 3) cases, avoiding both an invalid free and partial-allocation leaks.
Changes:
- Replace multiple error labels with a single
err:path that delegates cleanup tomod_fft_multi_plan_free(). - Ensure partial initialization (e.g., some
fft_plan[i]allocated, others NULL) is cleaned up consistently and safely.
lgirdwood
approved these changes
Jun 15, 2026
abonislawski
approved these changes
Jun 15, 2026
jsarha
approved these changes
Jun 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The error path of mod_fft_multi_plan_new() had two related bugs. With num_ffts == 1 the temporary input buffer aliases the caller-provided inb, but the err_free_buffer label freed plan->tmp_i32[0] unconditionally, which would have released the caller's buffer. With num_ffts == 3, a failure in the second or third fft_plan_common_new() call only freed the shared scratch buffer and the bit-reverse table, leaking the previously allocated fft_plan entries.
Collapse all error labels into a single err: that calls mod_fft_multi_plan_free(). That helper already walks fft_plan[] (NULL slots from the initial mod_zalloc() are no-ops in mod_free()) and only frees tmp_i32[0] when num_ffts > 1, so both issues are handled in one place.