diff options
| author | Zhipeng Lu <alexious@zju.edu.cn> | 2024-02-21 07:37:13 +0300 |
|---|---|---|
| committer | Sasha Levin <sashal@kernel.org> | 2024-03-27 01:17:14 +0300 |
| commit | 7405a0d4442792988e9ae834e7d84f9d163731a4 (patch) | |
| tree | 6d3c83b421c7a1f23d476c5afb4467cd6ad9e371 | |
| parent | ed514ecf4f29c80a2f09ae3c877059b401efe893 (diff) | |
| download | linux-7405a0d4442792988e9ae834e7d84f9d163731a4.tar.xz | |
media: go7007: fix a memleak in go7007_load_encoder
[ Upstream commit b9b683844b01d171a72b9c0419a2d760d946ee12 ]
In go7007_load_encoder, bounce(i.e. go->boot_fw), is allocated without
a deallocation thereafter. After the following call chain:
saa7134_go7007_init
|-> go7007_boot_encoder
|-> go7007_load_encoder
|-> kfree(go)
go is freed and thus bounce is leaked.
Fixes: 95ef39403f89 ("[media] go7007: remember boot firmware")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/media/usb/go7007/go7007-driver.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/drivers/media/usb/go7007/go7007-driver.c b/drivers/media/usb/go7007/go7007-driver.c index 0c24e2984304..eb03f98b2ef1 100644 --- a/drivers/media/usb/go7007/go7007-driver.c +++ b/drivers/media/usb/go7007/go7007-driver.c @@ -80,7 +80,7 @@ static int go7007_load_encoder(struct go7007 *go) const struct firmware *fw_entry; char fw_name[] = "go7007/go7007fw.bin"; void *bounce; - int fw_len, rv = 0; + int fw_len; u16 intr_val, intr_data; if (go->boot_fw == NULL) { @@ -109,9 +109,11 @@ static int go7007_load_encoder(struct go7007 *go) go7007_read_interrupt(go, &intr_val, &intr_data) < 0 || (intr_val & ~0x1) != 0x5a5a) { v4l2_err(go, "error transferring firmware\n"); - rv = -1; + kfree(go->boot_fw); + go->boot_fw = NULL; + return -1; } - return rv; + return 0; } MODULE_FIRMWARE("go7007/go7007fw.bin"); |