From: Alan Stern <stern@rowland.harvard.edu>
To: Hans Verkuil <hverkuil@xs4all.nl>
Cc: syzbot <syzbot+44e64397bd81d5e84cba@syzkaller.appspotmail.com>,
linux-media@vger.kernel.org, linux-usb@vger.kernel.org,
mchehab@kernel.org, syzkaller-bugs@googlegroups.com
Subject: [PATCH] media: gspca: Fix memory leak in probe
Date: Tue, 24 Nov 2020 11:00:26 -0500 [thread overview]
Message-ID: <20201124160026.GA749809@rowland.harvard.edu> (raw)
In-Reply-To: <c2cf1a80-ec47-69ac-c3e2-1b0e32447ef2@xs4all.nl>
The gspca driver leaks memory when a probe fails. gspca_dev_probe2()
calls v4l2_device_register(), which takes a reference to the
underlying device node (in this case, a USB interface). But the
failure pathway neglects to call v4l2_device_disconnect(), the routine
responsible for dropping this reference. Consequently the memory for
the USB interface and its device never gets released.
This patch adds the missing function call.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: syzbot+44e64397bd81d5e84cba@syzkaller.appspotmail.com
CC: <stable@vger.kernel.org>
---
This doesn't fully fix syzbot's test case, because the test goes on and
encounters another memory leak in a different driver.
[as1949]
drivers/media/usb/gspca/gspca.c | 1 +
1 file changed, 1 insertion(+)
Index: usb-devel/drivers/media/usb/gspca/gspca.c
===================================================================
--- usb-devel.orig/drivers/media/usb/gspca/gspca.c
+++ usb-devel/drivers/media/usb/gspca/gspca.c
@@ -1575,6 +1575,7 @@ out:
input_unregister_device(gspca_dev->input_dev);
#endif
v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler);
+ v4l2_device_disconnect(&gspca_dev->v4l2_dev);
kfree(gspca_dev->usb_buf);
kfree(gspca_dev);
return ret;
next prev parent reply other threads:[~2020-11-24 16:00 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-20 15:15 memory leak in hub_event syzbot
2020-11-20 16:56 ` Alan Stern
2020-11-20 16:56 ` syzbot
2020-11-20 17:00 ` Alan Stern
2020-11-23 18:29 ` Andrey Konovalov
2020-11-23 18:44 ` syzbot
2020-11-23 19:32 ` Alan Stern
2020-11-23 19:42 ` syzbot
2020-11-23 19:53 ` Alan Stern
2020-11-23 20:01 ` syzbot
2020-11-23 20:38 ` Alan Stern
2020-11-23 20:48 ` syzbot
2020-11-23 21:53 ` Alan Stern
2020-11-23 22:09 ` syzbot
2020-11-23 22:24 ` Alan Stern
2020-11-24 11:38 ` Hans Verkuil
2020-11-24 16:00 ` Alan Stern [this message]
2020-12-02 8:58 ` [PATCH] media: gspca: Fix memory leak in probe Hans Verkuil
2020-12-02 17:20 ` [PATCH v2] " Alan Stern
2020-12-02 16:22 ` memory leak in hub_event Alan Stern
2020-12-02 16:37 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201124160026.GA749809@rowland.harvard.edu \
--to=stern@rowland.harvard.edu \
--cc=hverkuil@xs4all.nl \
--cc=linux-media@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=syzbot+44e64397bd81d5e84cba@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.