From patchwork Thu Aug 11 04:57:00 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dongliang Mu X-Patchwork-Id: 85342 X-Patchwork-Delegate: hverkuil@xs4all.nl Received: from vger.kernel.org ([23.128.96.18]) by www.linuxtv.org with esmtp (Exim 4.92) (envelope-from ) id 1oM0IT-00DAuS-Tx; Thu, 11 Aug 2022 04:59:55 +0000 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233779AbiHKE7v (ORCPT + 1 other); Thu, 11 Aug 2022 00:59:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54060 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233459AbiHKE7u (ORCPT ); Thu, 11 Aug 2022 00:59:50 -0400 Received: from hust.edu.cn (unknown [202.114.0.240]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 43B087CB58; Wed, 10 Aug 2022 21:59:47 -0700 (PDT) Received: from localhost.localdomain ([172.16.0.254]) (user=dzm91@hust.edu.cn mech=LOGIN bits=0) by mx1.hust.edu.cn with ESMTP id 27B4w4gc000522-27B4w4gf000522 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Thu, 11 Aug 2022 12:58:08 +0800 From: Dongliang Mu To: Antti Palosaari , Mauro Carvalho Chehab , Hans Verkuil , Oliver Neukum Cc: Dongliang Mu , syzbot+bb25f85e5aa482864dc0@syzkaller.appspotmail.com, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] media: airspy: fix memory leak in airspy probe Date: Thu, 11 Aug 2022 12:57:00 +0800 Message-Id: <20220811045701.31152-1-dzm91@hust.edu.cn> X-Mailer: git-send-email 2.35.1 MIME-Version: 1.0 X-FEAS-AUTH-USER: dzm91@hust.edu.cn X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,SPF_HELO_PASS, SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-LSpam-Score: -2.4 (--) X-LSpam-Report: No, score=-2.4 required=5.0 tests=BAYES_00=-1.9,HEADER_FROM_DIFFERENT_DOMAINS=0.5,MAILING_LIST_MULTI=-1 autolearn=ham autolearn_force=no From: Dongliang Mu The commit ca9dc8d06ab6 ("media: airspy: respect the DMA coherency rules") moves variable buf from stack to heap, however, it only frees buf in the error handling code, missing deallocation in the success path. Fix this by freeing buf in the success path since this variable does not have any references in other code. Fixes: ca9dc8d06ab6 ("media: airspy: respect the DMA coherency rules") Reported-by: syzbot+bb25f85e5aa482864dc0@syzkaller.appspotmail.com Signed-off-by: Dongliang Mu Reviewed-by: Tommaso Merciai --- drivers/media/usb/airspy/airspy.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/media/usb/airspy/airspy.c b/drivers/media/usb/airspy/airspy.c index 240a7cc56777..7b1c40132555 100644 --- a/drivers/media/usb/airspy/airspy.c +++ b/drivers/media/usb/airspy/airspy.c @@ -1070,6 +1070,10 @@ static int airspy_probe(struct usb_interface *intf, ret); goto err_free_controls; } + + /* Free buf if success*/ + kfree(buf); + dev_info(s->dev, "Registered as %s\n", video_device_node_name(&s->vdev)); dev_notice(s->dev, "SDR API is still slightly experimental and functionality changes may follow\n");