Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 090c65b6 authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by Mauro Carvalho Chehab
Browse files

[media] usbvision-video: fix memory leak of alt_max_pkt_size 



1. usbvision->alt_max_pkt_size is not deallocated anywhere.
2. if allocation of usbvision->alt_max_pkt_size fails,
there is no proper deallocation of already acquired resources.
The patch adds kfree(usbvision->alt_max_pkt_size) to
usbvision_release() as soon as other deallocations happen there.
It calls usbvision_release() if allocation of
usbvision->alt_max_pkt_size fails as soon as usbvision_release()
is safe to work with incompletely initialized usbvision structure.
Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent b610b592

drivers/media/usb/usbvision/usbvision-video.c

+2 −0
Original line number Original line Diff line number Diff line
@@ -1460,6 +1460,7 @@ static void usbvision_release(struct usb_usbvision *usbvision) 




	usbvision_remove_sysfs(usbvision->vdev);

	usbvision_remove_sysfs(usbvision->vdev);

	usbvision_unregister_video(usbvision);

	usbvision_unregister_video(usbvision);

	kfree(usbvision->alt_max_pkt_size);





	usb_free_urb(usbvision->ctrl_urb);

	usb_free_urb(usbvision->ctrl_urb);
@@ -1575,6 +1576,7 @@ static int usbvision_probe(struct usb_interface *intf, 
	usbvision->alt_max_pkt_size = kmalloc(32 * usbvision->num_alt, GFP_KERNEL);

	usbvision->alt_max_pkt_size = kmalloc(32 * usbvision->num_alt, GFP_KERNEL);

	if (usbvision->alt_max_pkt_size == NULL) {

	if (usbvision->alt_max_pkt_size == NULL) {

		dev_err(&intf->dev, "usbvision: out of memory!\n");

		dev_err(&intf->dev, "usbvision: out of memory!\n");

		usbvision_release(usbvision);

		return -ENOMEM;

		return -ENOMEM;

	}

	}