Commit 7815d3a6 authored by Gaosheng Cui's avatar Gaosheng Cui Committed by Qi Xi
Browse files

media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal() 

mainline inclusion
from mainline-v6.13-rc1
commit 0f514068fbc5d4d189c817adc7c4e32cffdc2e47
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMP
CVE: CVE-2024-56572

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0f514068fbc5d4d189c817adc7c4e32cffdc2e47



--------------------------------

The buffer in the loop should be released under the exception path,
otherwise there may be a memory leak here.

To mitigate this, free the buffer when allegro_alloc_buffer fails.

Fixes: f20387df ("media: allegro: add Allegro DVT video IP core driver")
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarGaosheng Cui <cuigaosheng1@huawei.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>

Conflicts:
        drivers/media/platform/allegro-dvt/allegro-core.c
        drivers/staging/media/allegro-dvt/allegro-core.c
[Context conflicts]
Signed-off-by: default avatarQi Xi <xiqi2@huawei.com>
parent 8e6e5619

drivers/staging/media/allegro-dvt/allegro-core.c

+3 −1
Original line number Diff line number Diff line
@@ -1208,8 +1208,10 @@ static int allocate_buffers_internal(struct allegro_channel *channel, 
		INIT_LIST_HEAD(&buffer->head);



		err = allegro_alloc_buffer(dev, buffer, size);

		if (err)

		if (err) {

			kfree(buffer);

			goto err;

		}

		list_add(&buffer->head, list);

	}