* [PATCH v4] media: uvcvideo: Fix memory leak if uvc_ctrl_add_mapping fails
@ 2022-03-24 22:42 Ricardo Ribalda
2022-03-27 22:18 ` Laurent Pinchart
0 siblings, 1 reply; 2+ messages in thread
From: Ricardo Ribalda @ 2022-03-24 22:42 UTC (permalink / raw)
To: Laurent Pinchart, Mauro Carvalho Chehab, Hans Verkuil,
Ricardo Ribalda, linux-media, Colin King, tfiga
Move all the life cycle of the name to add_mapping. This simplifies
the error handling inside uvc_ioctl_ctrl_map and solves a memory leak
when kemmdup fails.
Fixes: 07adedb5c606 ("media: uvcvideo: Use control names from framework")
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
---
Laurent:
Please note that I have added xmap->name[0] == '\0' check!
Thanks
drivers/media/usb/uvc/uvc_ctrl.c | 10 ++++++++++
drivers/media/usb/uvc/uvc_v4l2.c | 8 ++++----
2 files changed, 14 insertions(+), 4 deletions(-)
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
index b4f6edf968bc..8b3bd516cb2f 100644
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -2188,11 +2188,21 @@ static int __uvc_ctrl_add_mapping(struct uvc_video_chain *chain,
if (map == NULL)
return -ENOMEM;
+ /* For UVCIOC_CTRL_MAP custom controls */
+ if (mapping->name) {
+ map->name = kstrdup(mapping->name, GFP_KERNEL);
+ if (!map->name) {
+ kfree(map);
+ return -ENOMEM;
+ }
+ }
+
INIT_LIST_HEAD(&map->ev_subs);
size = sizeof(*mapping->menu_info) * mapping->menu_count;
map->menu_info = kmemdup(mapping->menu_info, size, GFP_KERNEL);
if (map->menu_info == NULL) {
+ kfree(map->name);
kfree(map);
return -ENOMEM;
}
diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index 711556d13d03..ac829fb44b77 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -42,12 +42,12 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain,
map->id = xmap->id;
/* Non standard control id. */
if (v4l2_ctrl_get_name(map->id) == NULL) {
- map->name = kmemdup(xmap->name, sizeof(xmap->name),
- GFP_KERNEL);
- if (!map->name) {
- ret = -ENOMEM;
+ if (xmap->name[0] == '\0') {
+ ret = -EINVAL;
goto free_map;
}
+ xmap->name[sizeof(xmap->name) - 1] = '\0';
+ map->name = xmap->name;
}
memcpy(map->entity, xmap->entity, sizeof(map->entity));
map->selector = xmap->selector;
--
2.35.1.1021.g381101b075-goog
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v4] media: uvcvideo: Fix memory leak if uvc_ctrl_add_mapping fails
2022-03-24 22:42 [PATCH v4] media: uvcvideo: Fix memory leak if uvc_ctrl_add_mapping fails Ricardo Ribalda
@ 2022-03-27 22:18 ` Laurent Pinchart
0 siblings, 0 replies; 2+ messages in thread
From: Laurent Pinchart @ 2022-03-27 22:18 UTC (permalink / raw)
To: Ricardo Ribalda
Cc: Mauro Carvalho Chehab, Hans Verkuil, linux-media, Colin King, tfiga
Hi Ricardo,
Thank you for the patch.
On Thu, Mar 24, 2022 at 11:42:32PM +0100, Ricardo Ribalda wrote:
> Move all the life cycle of the name to add_mapping. This simplifies
> the error handling inside uvc_ioctl_ctrl_map and solves a memory leak
> when kemmdup fails.
>
> Fixes: 07adedb5c606 ("media: uvcvideo: Use control names from framework")
> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
> ---
>
> Laurent:
> Please note that I have added xmap->name[0] == '\0' check!
Could you mention it in the commit message then ?
> drivers/media/usb/uvc/uvc_ctrl.c | 10 ++++++++++
> drivers/media/usb/uvc/uvc_v4l2.c | 8 ++++----
> 2 files changed, 14 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
> index b4f6edf968bc..8b3bd516cb2f 100644
> --- a/drivers/media/usb/uvc/uvc_ctrl.c
> +++ b/drivers/media/usb/uvc/uvc_ctrl.c
> @@ -2188,11 +2188,21 @@ static int __uvc_ctrl_add_mapping(struct uvc_video_chain *chain,
> if (map == NULL)
> return -ENOMEM;
>
> + /* For UVCIOC_CTRL_MAP custom controls */
s/controls/controls./
My R-B still applies.
> + if (mapping->name) {
> + map->name = kstrdup(mapping->name, GFP_KERNEL);
> + if (!map->name) {
> + kfree(map);
> + return -ENOMEM;
> + }
> + }
> +
> INIT_LIST_HEAD(&map->ev_subs);
>
> size = sizeof(*mapping->menu_info) * mapping->menu_count;
> map->menu_info = kmemdup(mapping->menu_info, size, GFP_KERNEL);
> if (map->menu_info == NULL) {
> + kfree(map->name);
> kfree(map);
> return -ENOMEM;
> }
> diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
> index 711556d13d03..ac829fb44b77 100644
> --- a/drivers/media/usb/uvc/uvc_v4l2.c
> +++ b/drivers/media/usb/uvc/uvc_v4l2.c
> @@ -42,12 +42,12 @@ static int uvc_ioctl_ctrl_map(struct uvc_video_chain *chain,
> map->id = xmap->id;
> /* Non standard control id. */
> if (v4l2_ctrl_get_name(map->id) == NULL) {
> - map->name = kmemdup(xmap->name, sizeof(xmap->name),
> - GFP_KERNEL);
> - if (!map->name) {
> - ret = -ENOMEM;
> + if (xmap->name[0] == '\0') {
> + ret = -EINVAL;
> goto free_map;
> }
> + xmap->name[sizeof(xmap->name) - 1] = '\0';
> + map->name = xmap->name;
> }
> memcpy(map->entity, xmap->entity, sizeof(map->entity));
> map->selector = xmap->selector;
--
Regards,
Laurent Pinchart
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-03-27 22:18 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-03-24 22:42 [PATCH v4] media: uvcvideo: Fix memory leak if uvc_ctrl_add_mapping fails Ricardo Ribalda
2022-03-27 22:18 ` Laurent Pinchart
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.