lkml.org 
[lkml]   [2021]   [Jul]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.13 175/800] media: dvd_usb: memory leak in cinergyt2_fe_attach
    Date
    From: Dongliang Mu <mudongliangabcd@gmail.com>

    [ Upstream commit 9ad1efee086e0e913914fa2b2173efb830bad68c ]

    When the driver fails to talk with the hardware with dvb_usb_generic_rw,
    it will return an error to dvb_usb_adapter_frontend_init. However, the
    driver forgets to free the resource (e.g., struct cinergyt2_fe_state),
    which leads to a memory leak.

    Fix this by freeing struct cinergyt2_fe_state when dvb_usb_generic_rw
    fails in cinergyt2_frontend_attach.

    backtrace:
    [<0000000056e17b1a>] kmalloc include/linux/slab.h:552 [inline]
    [<0000000056e17b1a>] kzalloc include/linux/slab.h:682 [inline]
    [<0000000056e17b1a>] cinergyt2_fe_attach+0x21/0x80 drivers/media/usb/dvb-usb/cinergyT2-fe.c:271
    [<00000000ae0b1711>] cinergyt2_frontend_attach+0x21/0x70 drivers/media/usb/dvb-usb/cinergyT2-core.c:74
    [<00000000d0254861>] dvb_usb_adapter_frontend_init+0x11b/0x1b0 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:290
    [<0000000002e08ac6>] dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:84 [inline]
    [<0000000002e08ac6>] dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:173 [inline]
    [<0000000002e08ac6>] dvb_usb_device_init.cold+0x4d0/0x6ae drivers/media/usb/dvb-usb/dvb-usb-init.c:287

    Reported-by: syzbot+e1de8986786b3722050e@syzkaller.appspotmail.com
    Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
    Signed-off-by: Sean Young <sean@mess.org>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/usb/dvb-usb/cinergyT2-core.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/drivers/media/usb/dvb-usb/cinergyT2-core.c b/drivers/media/usb/dvb-usb/cinergyT2-core.c
    index 969a7ec71dff..4116ba5c45fc 100644
    --- a/drivers/media/usb/dvb-usb/cinergyT2-core.c
    +++ b/drivers/media/usb/dvb-usb/cinergyT2-core.c
    @@ -78,6 +78,8 @@ static int cinergyt2_frontend_attach(struct dvb_usb_adapter *adap)

    ret = dvb_usb_generic_rw(d, st->data, 1, st->data, 3, 0);
    if (ret < 0) {
    + if (adap->fe_adap[0].fe)
    + adap->fe_adap[0].fe->ops.release(adap->fe_adap[0].fe);
    deb_rc("cinergyt2_power_ctrl() Failed to retrieve sleep state info\n");
    }
    mutex_unlock(&d->data_mutex);
    --
    2.30.2


    \
     
     \ /
      Last update: 2021-07-12 10:25    [W:4.028 / U:0.168 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site