diff options
| author | Hans Verkuil <hverkuil-cisco@xs4all.nl> | 2021-04-08 12:31:20 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-05-22 10:59:18 +0200 |
| commit | a30d538ca26d8dc5a685351a01842ab839088e14 (patch) | |
| tree | 1e286d0ddd4944088b74b19b9d1da85fbb120d28 /drivers/media/usb/gspca/gspca.c | |
| parent | 821b08dad8744b02b86d1b12ef8f74982f37a35e (diff) | |
| download | linux-stable-a30d538ca26d8dc5a685351a01842ab839088e14.tar.gz linux-stable-a30d538ca26d8dc5a685351a01842ab839088e14.tar.bz2 linux-stable-a30d538ca26d8dc5a685351a01842ab839088e14.zip | |
media: gscpa/stv06xx: fix memory leak
[ Upstream commit 4f4e6644cd876c844cdb3bea2dd7051787d5ae25 ]
For two of the supported sensors the stv06xx driver allocates memory which
is stored in sd->sensor_priv. This memory is freed on a disconnect, but if
the probe() fails, then it isn't freed and so this leaks memory.
Add a new probe_error() op that drivers can use to free any allocated
memory in case there was a probe failure.
Thanks to Pavel Skripkin <paskripkin@gmail.com> for discovering the cause
of the memory leak.
Reported-and-tested-by: syzbot+e7f4c64a4248a0340c37@syzkaller.appspotmail.com
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/media/usb/gspca/gspca.c')
| -rw-r--r-- | drivers/media/usb/gspca/gspca.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspca.c index 93212ed80bf8..f0562b8eef56 100644 --- a/drivers/media/usb/gspca/gspca.c +++ b/drivers/media/usb/gspca/gspca.c @@ -1586,6 +1586,8 @@ out: #endif v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler); v4l2_device_unregister(&gspca_dev->v4l2_dev); + if (sd_desc->probe_error) + sd_desc->probe_error(gspca_dev); kfree(gspca_dev->usb_buf); kfree(gspca_dev); return ret; |