Commit be8656e6 authored by Pavel Skripkin's avatar Pavel Skripkin Committed by Mauro Carvalho Chehab
Browse files

media: cpia2: fix memory leak in cpia2_usb_probe 



syzbot reported leak in cpia2 usb driver. The problem was
in invalid error handling.

v4l2_device_register() is called in cpia2_init_camera_struct(), but
all error cases after cpia2_init_camera_struct() did not call the
v4l2_device_unregister()

Reported-by: default avatar <syzbot+d1e69c888f0d3866ead4@syzkaller.appspotmail.com>
Signed-off-by: default avatarPavel Skripkin <paskripkin@gmail.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
parent 27ba4427

drivers/media/usb/cpia2/cpia2.h

+1 −0
Original line number Diff line number Diff line
@@ -429,6 +429,7 @@ int cpia2_send_command(struct camera_data *cam, struct cpia2_command *cmd); 
int cpia2_do_command(struct camera_data *cam,

		     unsigned int command,

		     unsigned char direction, unsigned char param);

void cpia2_deinit_camera_struct(struct camera_data *cam, struct usb_interface *intf);

struct camera_data *cpia2_init_camera_struct(struct usb_interface *intf);

int cpia2_init_camera(struct camera_data *cam);

int cpia2_allocate_buffers(struct camera_data *cam);

drivers/media/usb/cpia2/cpia2_core.c

+12 −0
Original line number Diff line number Diff line
@@ -2163,6 +2163,18 @@ static void reset_camera_struct(struct camera_data *cam) 
	cam->height = cam->params.roi.height;

}



/******************************************************************************

 *

 *  cpia2_init_camera_struct

 *

 *  Deinitialize camera struct

 *****************************************************************************/

void cpia2_deinit_camera_struct(struct camera_data *cam, struct usb_interface *intf)

{

	v4l2_device_unregister(&cam->v4l2_dev);

	kfree(cam);

}



/******************************************************************************

 *

 *  cpia2_init_camera_struct

drivers/media/usb/cpia2/cpia2_usb.c

+7 −6
Original line number Diff line number Diff line
@@ -844,15 +844,13 @@ static int cpia2_usb_probe(struct usb_interface *intf, 
	ret = set_alternate(cam, USBIF_CMDONLY);

	if (ret < 0) {

		ERR("%s: usb_set_interface error (ret = %d)\n", __func__, ret);

		kfree(cam);

		return ret;

		goto alt_err;

	}





	if((ret = cpia2_init_camera(cam)) < 0) {

		ERR("%s: failed to initialize cpia2 camera (ret = %d)\n", __func__, ret);

		kfree(cam);

		return ret;

		goto alt_err;

	}

	LOG("  CPiA Version: %d.%02d (%d.%d)\n",

	       cam->params.version.firmware_revision_hi,
@@ -872,11 +870,14 @@ static int cpia2_usb_probe(struct usb_interface *intf, 
	ret = cpia2_register_camera(cam);

	if (ret < 0) {

		ERR("%s: Failed to register cpia2 camera (ret = %d)\n", __func__, ret);

		kfree(cam);

		return ret;

		goto alt_err;

	}



	return 0;



alt_err:

	cpia2_deinit_camera_struct(cam, intf);

	return ret;

}



/******************************************************************************