Commit f54408e4 authored May 09, 2024 by Zhipeng Lu Committed by openeuler-sync-bot May 10, 2024

media: ttpci: fix two memleaks in budget_av_attach

stable inclusion
from stable-v5.10.214
commit 910363473e4bf97da3c350e08d915546dd6cc30b
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9IH
CVE: CVE-2024-27073

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=910363473e4bf97da3c350e08d915546dd6cc30b



--------------------------------

[ Upstream commit d0b07f712bf61e1a3cf23c87c663791c42e50837 ]

When saa7146_register_device and saa7146_vv_init fails, budget_av_attach
should free the resources it allocates, like the error-handling of
ttpci_budget_init does. Besides, there are two fixme comment refers to
such deallocations.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
(cherry picked from commit 806c89e7)

parent 272aabf7

drivers/media/pci/ttpci/budget-av.c

+5 −3

Original line number	Diff line number	Diff line
		@@ -1462,7 +1462,8 @@ static int budget_av_attach(struct saa7146_dev *dev, struct saa7146_pci_extensio
		budget_av->has_saa7113 = 1;
		err = saa7146_vv_init(dev, &vv_data);
		if (err != 0) {
		/* fixme: proper cleanup here */
		ttpci_budget_deinit(&budget_av->budget);
		kfree(budget_av);
		ERR("cannot init vv subsystem\n");
		return err;
		}
		@@ -1471,9 +1472,10 @@ static int budget_av_attach(struct saa7146_dev *dev, struct saa7146_pci_extensio
		vv_data.vid_ops.vidioc_s_input = vidioc_s_input;

		if ((err = saa7146_register_device(&budget_av->vd, dev, "knc1", VFL_TYPE_VIDEO))) {
		/* fixme: proper cleanup here */
		ERR("cannot register capture v4l2 device\n");
		saa7146_vv_release(dev);
		ttpci_budget_deinit(&budget_av->budget);
		kfree(budget_av);
		ERR("cannot register capture v4l2 device\n");
		return err;
		}