diff options
| author | Alexey Khoroshilov <khoroshilov@ispras.ru> | 2013-06-10 17:32:29 -0300 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2016-02-13 10:34:13 +0000 |
| commit | 89e46440df357001b6d122af71befcc0551e7072 (patch) | |
| tree | 153fa182e3d7aae3e9d0535751de2c18fdb776a9 | |
| parent | a655ba1a8c185ef3d8ecc2709df568c1a7840b74 (diff) | |
| download | lwn-89e46440df357001b6d122af71befcc0551e7072.tar.gz lwn-89e46440df357001b6d122af71befcc0551e7072.zip | |
usbvision-video: fix memory leak of alt_max_pkt_size
commit 090c65b694c362adb19ec9c27de216a808ee443c upstream.
1. usbvision->alt_max_pkt_size is not deallocated anywhere.
2. if allocation of usbvision->alt_max_pkt_size fails,
there is no proper deallocation of already acquired resources.
The patch adds kfree(usbvision->alt_max_pkt_size) to
usbvision_release() as soon as other deallocations happen there.
It calls usbvision_release() if allocation of
usbvision->alt_max_pkt_size fails as soon as usbvision_release()
is safe to work with incompletely initialized usbvision structure.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
| -rw-r--r-- | drivers/media/video/usbvision/usbvision-video.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/media/video/usbvision/usbvision-video.c b/drivers/media/video/usbvision/usbvision-video.c index 5a74f5e07d7d..9041dd4ce878 100644 --- a/drivers/media/video/usbvision/usbvision-video.c +++ b/drivers/media/video/usbvision/usbvision-video.c @@ -1425,6 +1425,7 @@ static void usbvision_release(struct usb_usbvision *usbvision) usbvision_remove_sysfs(usbvision->vdev); usbvision_unregister_video(usbvision); + kfree(usbvision->alt_max_pkt_size); usb_free_urb(usbvision->ctrl_urb); @@ -1540,6 +1541,7 @@ static int __devinit usbvision_probe(struct usb_interface *intf, usbvision->alt_max_pkt_size = kmalloc(32 * usbvision->num_alt, GFP_KERNEL); if (usbvision->alt_max_pkt_size == NULL) { dev_err(&intf->dev, "usbvision: out of memory!\n"); + usbvision_release(usbvision); return -ENOMEM; } |