From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Muhammad Usama Anjum <musamaanjum@gmail.com>,
syzbot+889397c820fa56adf25d@syzkaller.appspotmail.com,
Hans Verkuil <hverkuil-cisco@xs4all.nl>,
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>,
Sasha Levin <sashal@kernel.org>,
linux-media@vger.kernel.org
Subject: [PATCH AUTOSEL 4.14 17/31] media: em28xx: fix memory leak
Date: Mon, 3 May 2021 12:41:50 -0400 [thread overview]
Message-ID: <20210503164204.2854178-17-sashal@kernel.org> (raw)
In-Reply-To: <20210503164204.2854178-1-sashal@kernel.org>
From: Muhammad Usama Anjum <musamaanjum@gmail.com>
[ Upstream commit 0ae10a7dc8992ee682ff0b1752ff7c83d472eef1 ]
If some error occurs, URB buffers should also be freed. If they aren't
freed with the dvb here, the em28xx_dvb_fini call doesn't frees the URB
buffers as dvb is set to NULL. The function in which error occurs should
do all the cleanup for the allocations it had done.
Tested the patch with the reproducer provided by syzbot. This patch
fixes the memleak.
Reported-by: syzbot+889397c820fa56adf25d@syzkaller.appspotmail.com
Signed-off-by: Muhammad Usama Anjum <musamaanjum@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/em28xx/em28xx-dvb.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c b/drivers/media/usb/em28xx/em28xx-dvb.c
index 29cdaaf1ed90..3667373f14d2 100644
--- a/drivers/media/usb/em28xx/em28xx-dvb.c
+++ b/drivers/media/usb/em28xx/em28xx-dvb.c
@@ -2056,6 +2056,7 @@ static int em28xx_dvb_init(struct em28xx *dev)
return result;
out_free:
+ em28xx_uninit_usb_xfer(dev, EM28XX_DIGITAL_MODE);
kfree(dvb);
dev->dvb = NULL;
goto ret;
--
2.30.2
next prev parent reply other threads:[~2021-05-03 17:07 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-03 16:41 [PATCH AUTOSEL 4.14 01/31] scsi: lpfc: Fix incorrect dbde assignment when building target abts wqe Sasha Levin
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 02/31] scsi: lpfc: Fix pt2pt connection does not recover after LOGO Sasha Levin
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 03/31] scsi: target: pscsi: Fix warning in pscsi_complete_cmd() Sasha Levin
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 04/31] media: ite-cir: check for receive overflow Sasha Levin
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 05/31] power: supply: bq27xxx: fix power_avg for newer ICs Sasha Levin
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 06/31] extcon: arizona: Fix some issues when HPDET IRQ fires after the jack has been unplugged Sasha Levin
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 07/31] media: media/saa7164: fix saa7164_encoder_register() memory leak bugs Sasha Levin
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 08/31] media: gspca/sq905.c: fix uninitialized variable Sasha Levin
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 09/31] media: pci: saa7164: Rudimentary spelling fixes in the file saa7164-types.h Sasha Levin
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 10/31] power: supply: Use IRQF_ONESHOT Sasha Levin
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 11/31] drm/bridge/analogix/anx78xx: Setup encoder before registering connector Sasha Levin
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 12/31] drm/bridge/analogix/anx78xx: Cleanup on error in anx78xx_bridge_attach() Sasha Levin
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 13/31] drm/amdgpu : Fix asic reset regression issue introduce by 8f211fe8ac7c4f Sasha Levin
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 14/31] scsi: qla2xxx: Always check the return value of qla24xx_get_isp_stats() Sasha Levin
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 15/31] scsi: qla2xxx: Fix use after free in bsg Sasha Levin
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 16/31] scsi: scsi_dh_alua: Remove check for ASC 24h in alua_rtpg() Sasha Levin
2021-05-03 16:41 ` Sasha Levin [this message]
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 18/31] media: vivid: update EDID Sasha Levin
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 19/31] clk: socfpga: arria10: Fix memory leak of socfpga_clk on error return Sasha Levin
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 20/31] power: supply: generic-adc-battery: fix possible use-after-free in gab_remove() Sasha Levin
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 21/31] power: supply: s3c_adc_battery: fix possible use-after-free in s3c_adc_bat_remove() Sasha Levin
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 22/31] media: adv7604: fix possible use-after-free in adv76xx_remove() Sasha Levin
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 23/31] media: i2c: adv7511-v4l2: fix possible use-after-free in adv7511_remove() Sasha Levin
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 24/31] media: i2c: adv7842: fix possible use-after-free in adv7842_remove() Sasha Levin
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 25/31] media: dvb-usb: fix memory leak in dvb_usb_adapter_init Sasha Levin
2021-05-03 16:41 ` [PATCH AUTOSEL 4.14 26/31] media: gscpa/stv06xx: fix memory leak Sasha Levin
2021-05-03 16:42 ` [PATCH AUTOSEL 4.14 27/31] drm/msm/mdp5: Configure PP_SYNC_HEIGHT to double the vtotal Sasha Levin
2021-05-03 16:42 ` [PATCH AUTOSEL 4.14 28/31] drm/amdgpu: fix NULL pointer dereference Sasha Levin
2021-05-03 16:42 ` [PATCH AUTOSEL 4.14 29/31] scsi: lpfc: Fix crash when a REG_RPI mailbox fails triggering a LOGO response Sasha Levin
2021-05-03 16:42 ` [PATCH AUTOSEL 4.14 30/31] scsi: lpfc: Remove unsupported mbox PORT_CAPABILITIES logic Sasha Levin
2021-05-03 16:42 ` [PATCH AUTOSEL 4.14 31/31] scsi: libfc: Fix a format specifier Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210503164204.2854178-17-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=hverkuil-cisco@xs4all.nl \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab+huawei@kernel.org \
--cc=musamaanjum@gmail.com \
--cc=stable@vger.kernel.org \
--cc=syzbot+889397c820fa56adf25d@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).