Commit 0bfaab64 authored by Zhipeng Lu's avatar Zhipeng Lu Committed by Cui GaoSheng
Browse files

media: ir_toy: fix a memleak in irtoy_tx 

stable inclusion
from stable-v5.10.210
commit 486a4176bc783df798bce2903824801af8d2c3ae
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HJP4
CVE: CVE-2024-26829

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=486a4176bc783df798bce2903824801af8d2c3ae



--------------------------------

[ Upstream commit dc9ceb90c4b42c6e5c6757df1d6257110433788e ]

When irtoy_command fails, buf should be freed since it is allocated by
irtoy_tx, or there is a memleak.

Fixes: 4114978d ("media: ir_toy: prevent device from hanging during transmit")
Signed-off-by: default avatarZhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: default avatarSean Young <sean@mess.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLin Yujun <linyujun809@huawei.com>
Signed-off-by: default avatarCui GaoSheng <cuigaosheng1@huawei.com>
parent ae52f9c5

drivers/media/rc/ir_toy.c

+2 −0
Original line number Diff line number Diff line
@@ -324,6 +324,7 @@ static int irtoy_tx(struct rc_dev *rc, uint *txbuf, uint count) 
			    sizeof(COMMAND_SMODE_EXIT), STATE_RESET);

	if (err) {

		dev_err(irtoy->dev, "exit sample mode: %d\n", err);

		kfree(buf);

		return err;

	}
@@ -331,6 +332,7 @@ static int irtoy_tx(struct rc_dev *rc, uint *txbuf, uint count) 
			    sizeof(COMMAND_SMODE_ENTER), STATE_COMMAND);

	if (err) {

		dev_err(irtoy->dev, "enter sample mode: %d\n", err);

		kfree(buf);

		return err;

	}