diff options
| author | Yang Yingliang <yangyingliang@huawei.com> | 2021-10-15 11:58:55 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-01-27 09:04:18 +0100 |
| commit | 74ea5eefe9e60ac7168f4e6554b8aaeac4aa8e37 (patch) | |
| tree | b69498ad4c45b5a27c723a8c983b6fee8de94a50 /drivers/media/radio | |
| parent | b8f691707f68aba6cfe40be07f1f914ecfe530ad (diff) | |
| download | linux-stable-74ea5eefe9e60ac7168f4e6554b8aaeac4aa8e37.tar.gz linux-stable-74ea5eefe9e60ac7168f4e6554b8aaeac4aa8e37.tar.bz2 linux-stable-74ea5eefe9e60ac7168f4e6554b8aaeac4aa8e37.zip | |
media: si470x-i2c: fix possible memory leak in si470x_i2c_probe()
[ Upstream commit ef054e345ed8c79ce1121a3599b5a2dfd78e57a0 ]
n the 'radio->hdl.error' error handling, ctrl handler allocated by
v4l2_ctrl_new_std() does not released, and caused memory leak as
follows:
unreferenced object 0xffff888033d54200 (size 256):
comm "i2c-si470x-19", pid 909, jiffies 4294914203 (age 8.072s)
hex dump (first 32 bytes):
e8 69 11 03 80 88 ff ff 00 46 d5 33 80 88 ff ff .i.......F.3....
10 42 d5 33 80 88 ff ff 10 42 d5 33 80 88 ff ff .B.3.....B.3....
backtrace:
[<00000000086bd4ed>] __kmalloc_node+0x1eb/0x360
[<00000000bdb68871>] kvmalloc_node+0x66/0x120
[<00000000fac74e4c>] v4l2_ctrl_new+0x7b9/0x1c60 [videodev]
[<00000000693bf940>] v4l2_ctrl_new_std+0x19b/0x270 [videodev]
[<00000000c0cb91bc>] si470x_i2c_probe+0x2d3/0x9a0 [radio_si470x_i2c]
[<0000000056a6f01f>] i2c_device_probe+0x4d8/0xbe0
Fix the error handling path to avoid memory leak.
Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: 8c081b6f9a9b ("media: radio: Critical v4l2 registration...")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/media/radio')
| -rw-r--r-- | drivers/media/radio/si470x/radio-si470x-i2c.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c index cc68bdac0c36..7c49eaee67f3 100644 --- a/drivers/media/radio/si470x/radio-si470x-i2c.c +++ b/drivers/media/radio/si470x/radio-si470x-i2c.c @@ -381,7 +381,7 @@ static int si470x_i2c_probe(struct i2c_client *client, if (radio->hdl.error) { retval = radio->hdl.error; dev_err(&client->dev, "couldn't register control\n"); - goto err_dev; + goto err_all; } /* video device initialization */ @@ -465,7 +465,6 @@ err_rds: kfree(radio->buffer); err_ctrl: v4l2_ctrl_handler_free(&radio->hdl); -err_dev: v4l2_device_unregister(&radio->v4l2_dev); err_radio: kfree(radio); |