| Message ID | 20210327082613.4702-1-paskripkin@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | media: usb: fix memory leak in em28xx_dvb_init | expand |
Hi! On Sat, 2021-03-27 at 11:01 +0200, Andy Shevchenko wrote: > > > On Saturday, March 27, 2021, Pavel Skripkin <paskripkin@gmail.com> > wrote: > > syzbot reported memory leak in em28xx_dvb_init()[1] > > The problem was in wrong error handling after > > em28xx_alloc_urbs()[2] > > call. > > In case of error allocated urbs must be freed > > > > > > I believe you may reduce twice the below backtrace and leave only > important line(s). Ok, I'll send new patch version soon. Thank you! > > > > backtrace: > > [<ffffffff8304c141>] kmalloc_array.constprop.0+0x41/0x60 > > include/linux/slab.h:594 > > [<ffffffff8304dba2>] kcalloc include/linux/slab.h:623 [inline] > > [<ffffffff8304dba2>] em28xx_alloc_urbs+0x102/0x550 > > drivers/media/usb/em28xx/em28xx-core.c:930 [2] > > [<ffffffff84279fa7>] em28xx_dvb_init > > drivers/media/usb/em28xx/em28xx-dvb.c:1517 [inline] [1] > > [<ffffffff84279fa7>] em28xx_dvb_init.cold+0xa3/0x2bb1 > > drivers/media/usb/em28xx/em28xx-dvb.c:1483 > > [<ffffffff8304e33b>] em28xx_init_extension+0x9b/0xe0 > > drivers/media/usb/em28xx/em28xx-core.c:1126 > > [<ffffffff83050143>] request_module_async+0x33/0x40 > > drivers/media/usb/em28xx/em28xx-cards.c:3406 > > [<ffffffff81259229>] process_one_work+0x2c9/0x600 > > kernel/workqueue.c:2275 > > [<ffffffff81259dbb>] process_scheduled_works > > kernel/workqueue.c:2337 [inline] > > [<ffffffff81259dbb>] worker_thread+0x2fb/0x5d0 > > kernel/workqueue.c:2426 > > [<ffffffff81261228>] kthread+0x178/0x1b0 kernel/kthread.c:292 > > [<ffffffff8100227f>] ret_from_fork+0x1f/0x30 > > arch/x86/entry/entry_64.S:294 > > > > Reported-by: syzbot+889397c820fa56adf25d@syzkaller.appspotmail.com > > Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> > > --- > > drivers/media/usb/em28xx/em28xx-dvb.c | 1 + > > 1 file changed, 1 insertion(+) > > > > diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c > > b/drivers/media/usb/em28xx/em28xx-dvb.c > > index 526424279637..471bd74667e3 100644 > > --- a/drivers/media/usb/em28xx/em28xx-dvb.c > > +++ b/drivers/media/usb/em28xx/em28xx-dvb.c > > @@ -2010,6 +2010,7 @@ static int em28xx_dvb_init(struct em28xx > > *dev) > > return result; > > > > out_free: > > + em28xx_uninit_usb_xfer(dev, EM28XX_DIGITAL_MODE); > > kfree(dvb); > > dev->dvb = NULL; > > goto ret; > > -- > > 2.30.2 > > > > > >
diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c b/drivers/media/usb/em28xx/em28xx-dvb.c index 526424279637..471bd74667e3 100644 --- a/drivers/media/usb/em28xx/em28xx-dvb.c +++ b/drivers/media/usb/em28xx/em28xx-dvb.c @@ -2010,6 +2010,7 @@ static int em28xx_dvb_init(struct em28xx *dev) return result; out_free: + em28xx_uninit_usb_xfer(dev, EM28XX_DIGITAL_MODE); kfree(dvb); dev->dvb = NULL; goto ret;
syzbot reported memory leak in em28xx_dvb_init()[1] The problem was in wrong error handling after em28xx_alloc_urbs()[2] call. In case of error allocated urbs must be freed backtrace: [<ffffffff8304c141>] kmalloc_array.constprop.0+0x41/0x60 include/linux/slab.h:594 [<ffffffff8304dba2>] kcalloc include/linux/slab.h:623 [inline] [<ffffffff8304dba2>] em28xx_alloc_urbs+0x102/0x550 drivers/media/usb/em28xx/em28xx-core.c:930 [2] [<ffffffff84279fa7>] em28xx_dvb_init drivers/media/usb/em28xx/em28xx-dvb.c:1517 [inline] [1] [<ffffffff84279fa7>] em28xx_dvb_init.cold+0xa3/0x2bb1 drivers/media/usb/em28xx/em28xx-dvb.c:1483 [<ffffffff8304e33b>] em28xx_init_extension+0x9b/0xe0 drivers/media/usb/em28xx/em28xx-core.c:1126 [<ffffffff83050143>] request_module_async+0x33/0x40 drivers/media/usb/em28xx/em28xx-cards.c:3406 [<ffffffff81259229>] process_one_work+0x2c9/0x600 kernel/workqueue.c:2275 [<ffffffff81259dbb>] process_scheduled_works kernel/workqueue.c:2337 [inline] [<ffffffff81259dbb>] worker_thread+0x2fb/0x5d0 kernel/workqueue.c:2426 [<ffffffff81261228>] kthread+0x178/0x1b0 kernel/kthread.c:292 [<ffffffff8100227f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 Reported-by: syzbot+889397c820fa56adf25d@syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> --- drivers/media/usb/em28xx/em28xx-dvb.c | 1 + 1 file changed, 1 insertion(+)