| From dc517e014733fc5994189b3ea10e7a26fa64c652 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 25 May 2021 15:06:52 +0200 |
| Subject: media: dvd_usb: memory leak in cinergyt2_fe_attach |
| |
| From: Dongliang Mu <mudongliangabcd@gmail.com> |
| |
| [ Upstream commit 9ad1efee086e0e913914fa2b2173efb830bad68c ] |
| |
| When the driver fails to talk with the hardware with dvb_usb_generic_rw, |
| it will return an error to dvb_usb_adapter_frontend_init. However, the |
| driver forgets to free the resource (e.g., struct cinergyt2_fe_state), |
| which leads to a memory leak. |
| |
| Fix this by freeing struct cinergyt2_fe_state when dvb_usb_generic_rw |
| fails in cinergyt2_frontend_attach. |
| |
| backtrace: |
| [<0000000056e17b1a>] kmalloc include/linux/slab.h:552 [inline] |
| [<0000000056e17b1a>] kzalloc include/linux/slab.h:682 [inline] |
| [<0000000056e17b1a>] cinergyt2_fe_attach+0x21/0x80 drivers/media/usb/dvb-usb/cinergyT2-fe.c:271 |
| [<00000000ae0b1711>] cinergyt2_frontend_attach+0x21/0x70 drivers/media/usb/dvb-usb/cinergyT2-core.c:74 |
| [<00000000d0254861>] dvb_usb_adapter_frontend_init+0x11b/0x1b0 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:290 |
| [<0000000002e08ac6>] dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:84 [inline] |
| [<0000000002e08ac6>] dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:173 [inline] |
| [<0000000002e08ac6>] dvb_usb_device_init.cold+0x4d0/0x6ae drivers/media/usb/dvb-usb/dvb-usb-init.c:287 |
| |
| Reported-by: syzbot+e1de8986786b3722050e@syzkaller.appspotmail.com |
| Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com> |
| Signed-off-by: Sean Young <sean@mess.org> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/media/usb/dvb-usb/cinergyT2-core.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| diff --git a/drivers/media/usb/dvb-usb/cinergyT2-core.c b/drivers/media/usb/dvb-usb/cinergyT2-core.c |
| index 969a7ec71dff..4116ba5c45fc 100644 |
| --- a/drivers/media/usb/dvb-usb/cinergyT2-core.c |
| +++ b/drivers/media/usb/dvb-usb/cinergyT2-core.c |
| @@ -78,6 +78,8 @@ static int cinergyt2_frontend_attach(struct dvb_usb_adapter *adap) |
| |
| ret = dvb_usb_generic_rw(d, st->data, 1, st->data, 3, 0); |
| if (ret < 0) { |
| + if (adap->fe_adap[0].fe) |
| + adap->fe_adap[0].fe->ops.release(adap->fe_adap[0].fe); |
| deb_rc("cinergyt2_power_ctrl() Failed to retrieve sleep state info\n"); |
| } |
| mutex_unlock(&d->data_mutex); |
| -- |
| 2.30.2 |
| |