Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b97a2097 authored by Lakshmi Narayana Kalavala's avatar Lakshmi Narayana Kalavala
Browse files

[media] v4l2: Fix the possible memory leak in v4l2 framework 



If the size of the command passed to video_usercopy function
is bigger than the supported stack size, the required size
is allocated from heap. In this case, the memory needs to
be freed, otherwise can result in memory leak

CRs-Fixed: 547486
Change-Id: I5268673cf5941ae55620592fadacbabee36cdf29
Signed-off-by: default avatarLakshmi Narayana Kalavala <lkalaval@codeaurora.org>
parent 61a09d4a

drivers/media/v4l2-core/v4l2-ioctl.c

+4 −0
Original line number Diff line number Diff line
@@ -2327,6 +2327,7 @@ video_usercopy(struct file *file, unsigned int cmd, unsigned long arg, 
	size_t  array_size = 0;

	void __user *user_ptr = NULL;

	void	**kernel_ptr = NULL;

	bool	heap_allocate = false;



	/*  Copy arguments into temp kernel buffer  */

	if (_IOC_DIR(cmd) != _IOC_NONE) {
@@ -2338,6 +2339,7 @@ video_usercopy(struct file *file, unsigned int cmd, unsigned long arg, 
			if (NULL == mbuf)

				return -ENOMEM;

			parg = mbuf;

			heap_allocate = true;

		}



		err = -EFAULT;
@@ -2419,6 +2421,8 @@ out_array_args: 


out:

	kfree(mbuf);

	if (heap_allocate)

		kfree(parg);

	return err;

}

EXPORT_SYMBOL(video_usercopy);