Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1bd505c8 authored by Pavel Skripkin's avatar Pavel Skripkin Committed by Sasha Levin
Browse files

media: drivers/media/usb: fix memory leak in zr364xx_probe 



[ Upstream commit 9c39be40c0155c43343f53e3a439290c0fec5542 ]

syzbot reported memory leak in zr364xx_probe()[1].
The problem was in invalid error handling order.
All error conditions rigth after v4l2_ctrl_handler_init()
must call v4l2_ctrl_handler_free().

Reported-by: default avatar <syzbot+efe9aefc31ae1e6f7675@syzkaller.appspotmail.com>
Signed-off-by: default avatarPavel Skripkin <paskripkin@gmail.com>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 705660a6

drivers/media/usb/zr364xx/zr364xx.c

+6 −7
Original line number Diff line number Diff line
@@ -1436,7 +1436,7 @@ static int zr364xx_probe(struct usb_interface *intf, 
	if (hdl->error) {

		err = hdl->error;

		dev_err(&udev->dev, "couldn't register control\n");

		goto unregister;

		goto free_hdlr_and_unreg_dev;

	}

	/* save the init method used by this camera */

	cam->method = id->driver_info;
@@ -1509,7 +1509,7 @@ static int zr364xx_probe(struct usb_interface *intf, 
	if (!cam->read_endpoint) {

		err = -ENOMEM;

		dev_err(&intf->dev, "Could not find bulk-in endpoint\n");

		goto unregister;

		goto free_hdlr_and_unreg_dev;

	}



	/* v4l */
@@ -1521,7 +1521,7 @@ static int zr364xx_probe(struct usb_interface *intf, 
	/* load zr364xx board specific */

	err = zr364xx_board_init(cam);

	if (err)

		goto unregister;

		goto free_hdlr_and_unreg_dev;

	err = v4l2_ctrl_handler_setup(hdl);

	if (err)

		goto board_uninit;
@@ -1539,7 +1539,7 @@ static int zr364xx_probe(struct usb_interface *intf, 
	err = video_register_device(&cam->vdev, VFL_TYPE_GRABBER, -1);

	if (err) {

		dev_err(&udev->dev, "video_register_device failed\n");

		goto free_handler;

		goto board_uninit;

	}

	cam->v4l2_dev.release = zr364xx_release;
@@ -1547,11 +1547,10 @@ static int zr364xx_probe(struct usb_interface *intf, 
		 video_device_node_name(&cam->vdev));

	return 0;



free_handler:

	v4l2_ctrl_handler_free(hdl);

board_uninit:

	zr364xx_board_uninit(cam);

unregister:

free_hdlr_and_unreg_dev:

	v4l2_ctrl_handler_free(hdl);

	v4l2_device_unregister(&cam->v4l2_dev);

free_cam:

	kfree(cam);