All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Dongliang Mu <mudongliangabcd@gmail.com>,
	syzbot+77b432d57c4791183ed4@syzkaller.appspotmail.com,
	Hans Verkuil <hverkuil-cisco@xs4all.nl>,
	Mauro Carvalho Chehab <mchehab@kernel.org>,
	Sasha Levin <sashal@kernel.org>,
	isely@pobox.com, linux-media@vger.kernel.org
Subject: [PATCH AUTOSEL 4.14 06/14] media: pvrusb2: fix memory leak in pvr_probe
Date: Thu, 11 Aug 2022 12:10:35 -0400	[thread overview]
Message-ID: <20220811161050.1543183-6-sashal@kernel.org> (raw)
In-Reply-To: <20220811161050.1543183-1-sashal@kernel.org>

From: Dongliang Mu <mudongliangabcd@gmail.com>

[ Upstream commit 945a9a8e448b65bec055d37eba58f711b39f66f0 ]

The error handling code in pvr2_hdw_create forgets to unregister the
v4l2 device. When pvr2_hdw_create returns back to pvr2_context_create,
it calls pvr2_context_destroy to destroy context, but mp->hdw is NULL,
which leads to that pvr2_hdw_destroy directly returns.

Fix this by adding v4l2_device_unregister to decrease the refcount of
usb interface.

Reported-by: syzbot+77b432d57c4791183ed4@syzkaller.appspotmail.com
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
index 4b0d44e25396..0abe50f1965a 100644
--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
@@ -2604,6 +2604,7 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf,
 		del_timer_sync(&hdw->encoder_run_timer);
 		del_timer_sync(&hdw->encoder_wait_timer);
 		flush_work(&hdw->workpoll);
+		v4l2_device_unregister(&hdw->v4l2_dev);
 		usb_free_urb(hdw->ctl_read_urb);
 		usb_free_urb(hdw->ctl_write_urb);
 		kfree(hdw->ctl_read_buffer);
-- 
2.35.1


  parent reply	other threads:[~2022-08-11 16:37 UTC|newest]

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-08-11 16:10 [PATCH AUTOSEL 4.14 01/14] drm/r128: Fix undefined behavior due to shift overflowing the constant Sasha Levin
2022-08-11 16:10 ` Sasha Levin
2022-08-11 16:10 ` [PATCH AUTOSEL 4.14 02/14] drm/radeon: integer overflow in radeon_mode_dumb_create() Sasha Levin
2022-08-11 16:10   ` Sasha Levin
2022-08-11 16:10   ` Sasha Levin
2022-08-11 16:10 ` [PATCH AUTOSEL 4.14 03/14] drm/radeon: Initialize fences array entries in radeon_sa_bo_next_hole Sasha Levin
2022-08-11 16:10   ` Sasha Levin
2022-08-11 16:10   ` Sasha Levin
2022-08-11 16:10 ` [PATCH AUTOSEL 4.14 04/14] media: davinci: vpif: add missing of_node_put() in vpif_probe() Sasha Levin
2022-08-11 16:10 ` [PATCH AUTOSEL 4.14 05/14] media: airspy: respect the DMA coherency rules Sasha Levin
2022-08-11 16:10 ` Sasha Levin [this message]
2022-08-11 16:10 ` [PATCH AUTOSEL 4.14 07/14] mlxsw: cmd: Increase 'config_profile.flood_mode' length Sasha Levin
2022-08-11 16:10 ` [PATCH AUTOSEL 4.14 08/14] crypto: vmx - Fix warning on p8_ghash_alg Sasha Levin
2022-08-11 16:10   ` Sasha Levin
2022-08-11 16:10 ` [PATCH AUTOSEL 4.14 09/14] drm/nouveau/nvkm: use list_add_tail() when building object tree Sasha Levin
2022-08-11 16:10   ` Sasha Levin
2022-08-11 16:10   ` [Nouveau] " Sasha Levin
2022-08-11 16:10 ` [PATCH AUTOSEL 4.14 10/14] can: sja1000: Add Quirk for RZ/N1 SJA1000 CAN controller Sasha Levin
2022-08-11 16:10 ` [PATCH AUTOSEL 4.14 11/14] net/cdc_ncm: Increase NTB max RX/TX values to 64kb Sasha Levin
2022-08-11 16:10 ` [PATCH AUTOSEL 4.14 12/14] wifi: rtl8xxxu: Fix the error handling of the probe function Sasha Levin
2022-08-11 16:10 ` [PATCH AUTOSEL 4.14 13/14] d_add_ci(): make sure we don't miss d_lookup_done() Sasha Levin
2022-08-11 16:10 ` [PATCH AUTOSEL 4.14 14/14] fs/dcache: Disable preemption on i_dir_seq write side on PREEMPT_RT Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220811161050.1543183-6-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=hverkuil-cisco@xs4all.nl \
    --cc=isely@pobox.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-media@vger.kernel.org \
    --cc=mchehab@kernel.org \
    --cc=mudongliangabcd@gmail.com \
    --cc=stable@vger.kernel.org \
    --cc=syzbot+77b432d57c4791183ed4@syzkaller.appspotmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.