lkml.org 
[lkml]   [2021]   [May]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.11 154/342] media: drivers/media/usb: fix memory leak in zr364xx_probe
    Date
    From: Pavel Skripkin <paskripkin@gmail.com>

    [ Upstream commit 9c39be40c0155c43343f53e3a439290c0fec5542 ]

    syzbot reported memory leak in zr364xx_probe()[1].
    The problem was in invalid error handling order.
    All error conditions rigth after v4l2_ctrl_handler_init()
    must call v4l2_ctrl_handler_free().

    Reported-by: syzbot+efe9aefc31ae1e6f7675@syzkaller.appspotmail.com
    Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/usb/zr364xx/zr364xx.c | 13 ++++++-------
    1 file changed, 6 insertions(+), 7 deletions(-)

    diff --git a/drivers/media/usb/zr364xx/zr364xx.c b/drivers/media/usb/zr364xx/zr364xx.c
    index d29b861367ea..1ef611e08323 100644
    --- a/drivers/media/usb/zr364xx/zr364xx.c
    +++ b/drivers/media/usb/zr364xx/zr364xx.c
    @@ -1430,7 +1430,7 @@ static int zr364xx_probe(struct usb_interface *intf,
    if (hdl->error) {
    err = hdl->error;
    dev_err(&udev->dev, "couldn't register control\n");
    - goto unregister;
    + goto free_hdlr_and_unreg_dev;
    }
    /* save the init method used by this camera */
    cam->method = id->driver_info;
    @@ -1503,7 +1503,7 @@ static int zr364xx_probe(struct usb_interface *intf,
    if (!cam->read_endpoint) {
    err = -ENOMEM;
    dev_err(&intf->dev, "Could not find bulk-in endpoint\n");
    - goto unregister;
    + goto free_hdlr_and_unreg_dev;
    }

    /* v4l */
    @@ -1515,7 +1515,7 @@ static int zr364xx_probe(struct usb_interface *intf,
    /* load zr364xx board specific */
    err = zr364xx_board_init(cam);
    if (err)
    - goto unregister;
    + goto free_hdlr_and_unreg_dev;
    err = v4l2_ctrl_handler_setup(hdl);
    if (err)
    goto board_uninit;
    @@ -1533,7 +1533,7 @@ static int zr364xx_probe(struct usb_interface *intf,
    err = video_register_device(&cam->vdev, VFL_TYPE_VIDEO, -1);
    if (err) {
    dev_err(&udev->dev, "video_register_device failed\n");
    - goto free_handler;
    + goto board_uninit;
    }
    cam->v4l2_dev.release = zr364xx_release;

    @@ -1541,11 +1541,10 @@ static int zr364xx_probe(struct usb_interface *intf,
    video_device_node_name(&cam->vdev));
    return 0;

    -free_handler:
    - v4l2_ctrl_handler_free(hdl);
    board_uninit:
    zr364xx_board_uninit(cam);
    -unregister:
    +free_hdlr_and_unreg_dev:
    + v4l2_ctrl_handler_free(hdl);
    v4l2_device_unregister(&cam->v4l2_dev);
    free_cam:
    kfree(cam);
    --
    2.30.2


    \
     
     \ /
      Last update: 2021-05-10 14:02    [W:5.555 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site