xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

media: cpia2: fix memory leak in cpia2_usb_probe

Browse Source 
[ Upstream commit be8656e62e9e791837b606a027802b504a945c97 ]

syzbot reported leak in cpia2 usb driver. The problem was
in invalid error handling.

v4l2_device_register() is called in cpia2_init_camera_struct(), but
all error cases after cpia2_init_camera_struct() did not call the
v4l2_device_unregister()

Reported-by: syzbot+d1e69c888f0d3866ead4@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Pavel Skripkin
2021-04-21 21:43:45 +02:00
committed by Greg Kroah-Hartman
parent e717d6c291
commit 4626df7f65
3 changed files with 20 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
drivers/media/usb/cpia2/cpia2.h
View File

@@ -429,6 +429,7 @@ int cpia2_send_command(struct camera_data *cam, struct cpia2_command *cmd);
int cpia2_do_command(struct camera_data *cam, int cpia2_do_command(struct camera_data *cam,
unsigned int command, unsigned int command,
unsigned char direction, unsigned char param); unsigned char direction, unsigned char param);
void cpia2_deinit_camera_struct(struct camera_data *cam, struct usb_interface *intf);
struct camera_data *cpia2_init_camera_struct(struct usb_interface *intf); struct camera_data *cpia2_init_camera_struct(struct usb_interface *intf);
int cpia2_init_camera(struct camera_data *cam); int cpia2_init_camera(struct camera_data *cam);
int cpia2_allocate_buffers(struct camera_data *cam); int cpia2_allocate_buffers(struct camera_data *cam);

12
drivers/media/usb/cpia2/cpia2_core.c
View File

@@ -2163,6 +2163,18 @@ static void reset_camera_struct(struct camera_data *cam)
cam->height = cam->params.roi.height; cam->height = cam->params.roi.height;
} }
/******************************************************************************
*
* cpia2_init_camera_struct
*
* Deinitialize camera struct
*****************************************************************************/
void cpia2_deinit_camera_struct(struct camera_data *cam, struct usb_interface *intf)
{
v4l2_device_unregister(&cam->v4l2_dev);
kfree(cam);
}
/****************************************************************************** /******************************************************************************
* *
* cpia2_init_camera_struct * cpia2_init_camera_struct

13
drivers/media/usb/cpia2/cpia2_usb.c
View File

@@ -844,15 +844,13 @@ static int cpia2_usb_probe(struct usb_interface *intf,
ret = set_alternate(cam, USBIF_CMDONLY); ret = set_alternate(cam, USBIF_CMDONLY);
if (ret < 0) { if (ret < 0) {
ERR("%s: usb_set_interface error (ret = %d)\n", __func__, ret); ERR("%s: usb_set_interface error (ret = %d)\n", __func__, ret);
kfree(cam); goto alt_err;
return ret;
} }
if((ret = cpia2_init_camera(cam)) < 0) { if((ret = cpia2_init_camera(cam)) < 0) {
ERR("%s: failed to initialize cpia2 camera (ret = %d)\n", __func__, ret); ERR("%s: failed to initialize cpia2 camera (ret = %d)\n", __func__, ret);
kfree(cam); goto alt_err;
return ret;
} }
LOG(" CPiA Version: %d.%02d (%d.%d)\n", LOG(" CPiA Version: %d.%02d (%d.%d)\n",
cam->params.version.firmware_revision_hi, cam->params.version.firmware_revision_hi,
@@ -872,11 +870,14 @@ static int cpia2_usb_probe(struct usb_interface *intf,
ret = cpia2_register_camera(cam); ret = cpia2_register_camera(cam);
if (ret < 0) { if (ret < 0) {
ERR("%s: Failed to register cpia2 camera (ret = %d)\n", __func__, ret); ERR("%s: Failed to register cpia2 camera (ret = %d)\n", __func__, ret);
kfree(cam); goto alt_err;
return ret;
} }
return 0; return 0;
alt_err:
cpia2_deinit_camera_struct(cam, intf);
return ret;
} }
/****************************************************************************** /******************************************************************************