drivers/media/usb: fix memory leak in zr364xx_probe
Subsystems (2)
PATCH 1/1 drivers/media/usb: fix memory leak in zr364xx_probe
syzbot reported memory leak in zr364xx_probe()[1]. The problem was in invalid error handling order. All error conditions rigth after v4l2_ctrl_handler_init() must call v4l2_ctrl_handler_free().
Reported-by [email protected]
Signed-off-by Pavel Skripkin <[email protected]>
--- drivers/media/usb/zr364xx/zr364xx.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
drivers/media/usb/zr364xx/zr364xx.c +6 -7
@@ -1430,7 +1430,7 @@ static int zr364xx_probe(struct usb_interface *intf,if (hdl->error) { err = hdl->error;dev_err (&udev->dev,"couldn't register control\n" ); - goto unregister; + goto free_hdlr_and_unreg_dev; }/* save the init method used by this camera */ cam->method = id->driver_info;
@@ -1503,7 +1503,7 @@ static int zr364xx_probe(struct usb_interface *intf,if (!cam->read_endpoint) { err = -ENOMEM ;dev_err (&intf->dev,"Could not find bulk-in endpoint\n" ); - goto unregister; + goto free_hdlr_and_unreg_dev; }/* v4l */
@@ -1515,7 +1515,7 @@ static int zr364xx_probe(struct usb_interface *intf,/* load zr364xx board specific */ err =zr364xx_board_init (cam);if (err) - goto unregister; + goto free_hdlr_and_unreg_dev; err =v4l2_ctrl_handler_setup (hdl);if (err) goto board_uninit;
@@ -1533,7 +1533,7 @@ static int zr364xx_probe(struct usb_interface *intf, err =video_register_device (&cam->vdev,VFL_TYPE_VIDEO ,-1 );if (err) {dev_err (&udev->dev,"video_register_device failed\n" ); - goto free_handler; + goto board_uninit; } cam->v4l2_dev.release = zr364xx_release;
@@ -1541,11 +1541,10 @@ static int zr364xx_probe(struct usb_interface *intf, video_device_node_name(&cam->vdev));return 0 ; -free_handler: -v4l2_ctrl_handler_free (hdl); board_uninit:zr364xx_board_uninit (cam); -unregister: +free_hdlr_and_unreg_dev: +v4l2_ctrl_handler_free (hdl);v4l2_device_unregister (&cam->v4l2_dev); free_cam:kfree (cam);
Signature · 1 line
2.25.1