From 9c39be40c0155c43343f53e3a439290c0fec5542 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Mon, 1 Mar 2021 21:38:26 +0100
Subject: [PATCH] media: drivers/media/usb: fix memory leak in zr364xx_probe
Git-commit: 9c39be40c0155c43343f53e3a439290c0fec5542
Patch-mainline: v5.13-rc1
References: git-fixes
syzbot reported memory leak in zr364xx_probe()[1].
The problem was in invalid error handling order.
All error conditions rigth after v4l2_ctrl_handler_init()
must call v4l2_ctrl_handler_free().
Reported-by: syzbot+efe9aefc31ae1e6f7675@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Acked-by: Takashi Iwai <tiwai@suse.de>
---
drivers/media/usb/zr364xx/zr364xx.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
--- a/drivers/media/usb/zr364xx/zr364xx.c
+++ b/drivers/media/usb/zr364xx/zr364xx.c
@@ -1443,7 +1443,7 @@ static int zr364xx_probe(struct usb_inte
if (hdl->error) {
err = hdl->error;
dev_err(&udev->dev, "couldn't register control\n");
- goto unregister;
+ goto free_hdlr_and_unreg_dev;
}
/* save the init method used by this camera */
cam->method = id->driver_info;
@@ -1516,7 +1516,7 @@ static int zr364xx_probe(struct usb_inte
if (!cam->read_endpoint) {
err = -ENOMEM;
dev_err(&intf->dev, "Could not find bulk-in endpoint\n");
- goto unregister;
+ goto free_hdlr_and_unreg_dev;
}
/* v4l */
@@ -1528,7 +1528,7 @@ static int zr364xx_probe(struct usb_inte
/* load zr364xx board specific */
err = zr364xx_board_init(cam);
if (err)
- goto unregister;
+ goto free_hdlr_and_unreg_dev;
err = v4l2_ctrl_handler_setup(hdl);
if (err)
goto board_uninit;
@@ -1546,7 +1546,7 @@ static int zr364xx_probe(struct usb_inte
err = video_register_device(&cam->vdev, VFL_TYPE_GRABBER, -1);
if (err) {
dev_err(&udev->dev, "video_register_device failed\n");
- goto free_handler;
+ goto board_uninit;
}
cam->v4l2_dev.release = zr364xx_release;
@@ -1554,11 +1554,10 @@ static int zr364xx_probe(struct usb_inte
video_device_node_name(&cam->vdev));
return 0;
-free_handler:
- v4l2_ctrl_handler_free(hdl);
board_uninit:
zr364xx_board_uninit(cam);
-unregister:
+free_hdlr_and_unreg_dev:
+ v4l2_ctrl_handler_free(hdl);
v4l2_device_unregister(&cam->v4l2_dev);
free_cam:
kfree(cam);