diff options
| author | Hans Verkuil <hverkuil-cisco@xs4all.nl> | 2021-04-08 13:31:20 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-05-11 15:04:11 +0300 |
| commit | 53995be39f937008b36c0d9e9fff91b86fbb1b77 (patch) | |
| tree | 099886668c8e18bcc7708d2d7e1bf0776d333f6b /drivers/media/usb/gspca/gspca.c | |
| parent | 3a855efb54260910d1766a9c50fc94f0fae30a85 (diff) | |
| download | linux-53995be39f937008b36c0d9e9fff91b86fbb1b77.tar.xz | |
media: gscpa/stv06xx: fix memory leak
[ Upstream commit 4f4e6644cd876c844cdb3bea2dd7051787d5ae25 ]
For two of the supported sensors the stv06xx driver allocates memory which
is stored in sd->sensor_priv. This memory is freed on a disconnect, but if
the probe() fails, then it isn't freed and so this leaks memory.
Add a new probe_error() op that drivers can use to free any allocated
memory in case there was a probe failure.
Thanks to Pavel Skripkin <paskripkin@gmail.com> for discovering the cause
of the memory leak.
Reported-and-tested-by: syzbot+e7f4c64a4248a0340c37@syzkaller.appspotmail.com
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/media/usb/gspca/gspca.c')
| -rw-r--r-- | drivers/media/usb/gspca/gspca.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspca.c index 4210826cc910..e4d78e676e74 100644 --- a/drivers/media/usb/gspca/gspca.c +++ b/drivers/media/usb/gspca/gspca.c @@ -1576,6 +1576,8 @@ out: #endif v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler); v4l2_device_unregister(&gspca_dev->v4l2_dev); + if (sd_desc->probe_error) + sd_desc->probe_error(gspca_dev); kfree(gspca_dev->usb_buf); kfree(gspca_dev); return ret; |