Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c666355e authored by Luke Nowakowski-Krijger's avatar Luke Nowakowski-Krijger Committed by Mauro Carvalho Chehab
Browse files

media: radio-raremono: change devm_k*alloc to k*alloc 



Change devm_k*alloc to k*alloc to manually allocate memory

The manual allocation and freeing of memory is necessary because when
the USB radio is disconnected, the memory associated with devm_k*alloc
is freed. Meaning if we still have unresolved references to the radio
device, then we get use-after-free errors.

This patch fixes this by manually allocating memory, and freeing it in
the v4l2.release callback that gets called when the last radio device
exits.

Reported-and-tested-by: default avatar <syzbot+a4387f5b6b799f6becbf@syzkaller.appspotmail.com>

Signed-off-by: default avatarLuke Nowakowski-Krijger <lnowakow@eng.ucsd.edu>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
[hverkuil-cisco@xs4all.nl: cleaned up two small checkpatch.pl warnings]
[hverkuil-cisco@xs4all.nl: prefix subject with driver name]
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
parent b09a2ab2

drivers/media/radio/radio-raremono.c

+23 −7
Original line number Original line Diff line number Diff line
@@ -269,6 +269,14 @@ static int vidioc_g_frequency(struct file *file, void *priv, 
	return 0;

	return 0;

}

}





static void raremono_device_release(struct v4l2_device *v4l2_dev)

{

	struct raremono_device *radio = to_raremono_dev(v4l2_dev);



	kfree(radio->buffer);

	kfree(radio);

}



/* File system interface */

/* File system interface */

static const struct v4l2_file_operations usb_raremono_fops = {

static const struct v4l2_file_operations usb_raremono_fops = {

	.owner		= THIS_MODULE,

	.owner		= THIS_MODULE,
@@ -293,12 +301,14 @@ static int usb_raremono_probe(struct usb_interface *intf, 
	struct raremono_device *radio;

	struct raremono_device *radio;

	int retval = 0;

	int retval = 0;





	radio = devm_kzalloc(&intf->dev, sizeof(struct raremono_device), GFP_KERNEL);

	radio = kzalloc(sizeof(*radio), GFP_KERNEL);

	if (radio)

	if (!radio)

		radio->buffer = devm_kmalloc(&intf->dev, BUFFER_LENGTH, GFP_KERNEL);



	if (!radio || !radio->buffer)

		return -ENOMEM;

		return -ENOMEM;

	radio->buffer = kmalloc(BUFFER_LENGTH, GFP_KERNEL);

	if (!radio->buffer) {

		kfree(radio);

		return -ENOMEM;

	}





	radio->usbdev = interface_to_usbdev(intf);

	radio->usbdev = interface_to_usbdev(intf);

	radio->intf = intf;

	radio->intf = intf;
@@ -322,7 +332,8 @@ static int usb_raremono_probe(struct usb_interface *intf, 
	if (retval != 3 ||

	if (retval != 3 ||

	    (get_unaligned_be16(&radio->buffer[1]) & 0xfff) == 0x0242) {

	    (get_unaligned_be16(&radio->buffer[1]) & 0xfff) == 0x0242) {

		dev_info(&intf->dev, "this is not Thanko's Raremono.\n");

		dev_info(&intf->dev, "this is not Thanko's Raremono.\n");

		return -ENODEV;

		retval = -ENODEV;

		goto free_mem;

	}

	}





	dev_info(&intf->dev, "Thanko's Raremono connected: (%04X:%04X)\n",

	dev_info(&intf->dev, "Thanko's Raremono connected: (%04X:%04X)\n",
@@ -331,7 +342,7 @@ static int usb_raremono_probe(struct usb_interface *intf, 
	retval = v4l2_device_register(&intf->dev, &radio->v4l2_dev);

	retval = v4l2_device_register(&intf->dev, &radio->v4l2_dev);

	if (retval < 0) {

	if (retval < 0) {

		dev_err(&intf->dev, "couldn't register v4l2_device\n");

		dev_err(&intf->dev, "couldn't register v4l2_device\n");

		return retval;

		goto free_mem;

	}

	}





	mutex_init(&radio->lock);

	mutex_init(&radio->lock);
@@ -344,6 +355,7 @@ static int usb_raremono_probe(struct usb_interface *intf, 
	radio->vdev.lock = &radio->lock;

	radio->vdev.lock = &radio->lock;

	radio->vdev.release = video_device_release_empty;

	radio->vdev.release = video_device_release_empty;

	radio->vdev.device_caps = V4L2_CAP_TUNER | V4L2_CAP_RADIO;

	radio->vdev.device_caps = V4L2_CAP_TUNER | V4L2_CAP_RADIO;

	radio->v4l2_dev.release = raremono_device_release;





	usb_set_intfdata(intf, &radio->v4l2_dev);

	usb_set_intfdata(intf, &radio->v4l2_dev);
@@ -359,6 +371,10 @@ static int usb_raremono_probe(struct usb_interface *intf, 
	}

	}

	dev_err(&intf->dev, "could not register video device\n");

	dev_err(&intf->dev, "could not register video device\n");

	v4l2_device_unregister(&radio->v4l2_dev);

	v4l2_device_unregister(&radio->v4l2_dev);



free_mem:

	kfree(radio->buffer);

	kfree(radio);

	return retval;

	return retval;

}

}