Commit 4c02261b authored May 08, 2024 by Zhipeng Lu Committed by Zhang Changzhong May 08, 2024

media: ttpci: fix two memleaks in budget_av_attach

mainline inclusion
from mainline-v6.9-rc1
commit d0b07f712bf61e1a3cf23c87c663791c42e50837
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9IH
CVE: CVE-2024-27073

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d0b07f712bf61e1a3cf23c87c663791c42e50837



---------------------------

When saa7146_register_device and saa7146_vv_init fails, budget_av_attach
should free the resources it allocates, like the error-handling of
ttpci_budget_init does. Besides, there are two fixme comment refers to
such deallocations.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Conflicts:
	drivers/media/pci/ttpci/budget-av.c
[commit 3e30a927 ("media: media/pci: rename VFL_TYPE_GRABBER to _VIDEO") was not merged]
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>

parent b9f13a64

drivers/media/pci/ttpci/budget-av.c

+5 −3

Original line number	Diff line number	Diff line
		@@ -1476,7 +1476,8 @@ static int budget_av_attach(struct saa7146_dev *dev, struct saa7146_pci_extensio
		budget_av->has_saa7113 = 1;
		err = saa7146_vv_init(dev, &vv_data);
		if (err != 0) {
		/* fixme: proper cleanup here */
		ttpci_budget_deinit(&budget_av->budget);
		kfree(budget_av);
		ERR("cannot init vv subsystem\n");
		return err;
		}
		@@ -1485,9 +1486,10 @@ static int budget_av_attach(struct saa7146_dev *dev, struct saa7146_pci_extensio
		vv_data.vid_ops.vidioc_s_input = vidioc_s_input;

		if ((err = saa7146_register_device(&budget_av->vd, dev, "knc1", VFL_TYPE_GRABBER))) {
		/* fixme: proper cleanup here */
		ERR("cannot register capture v4l2 device\n");
		saa7146_vv_release(dev);
		ttpci_budget_deinit(&budget_av->budget);
		kfree(budget_av);
		ERR("cannot register capture v4l2 device\n");
		return err;
		}