Kernel/linux-next
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git synced 2025-01-17 13:58:46 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

media: go7007: fix a memleak in go7007_load_encoder

Browse Source 
In go7007_load_encoder, bounce(i.e. go->boot_fw), is allocated without
a deallocation thereafter. After the following call chain:

saa7134_go7007_init
  |-> go7007_boot_encoder
        |-> go7007_load_encoder
  |-> kfree(go)

go is freed and thus bounce is leaked.

Fixes: 95ef39403f89 ("[media] go7007: remember boot firmware")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
This commit is contained in:
Zhipeng Lu 2024-02-21 12:37:13 +08:00 committed by Hans Verkuil
parent 7a4cf27d1f
commit b9b683844b
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/media/usb/go7007/go7007-driver.c
View File

@ -80,7 +80,7 @@ static int go7007_load_encoder(struct go7007 *go)
const struct firmware *fw_entry;
char fw_name[] = "go7007/go7007fw.bin";
void *bounce;
int fw_len, rv = 0;
int fw_len;
u16 intr_val, intr_data;
if (go->boot_fw == NULL) {
@ -109,9 +109,11 @@ static int go7007_load_encoder(struct go7007 *go)
go7007_read_interrupt(go, &intr_val, &intr_data) < 0 ||
(intr_val & ~0x1) != 0x5a5a) {
v4l2_err(go, "error transferring firmware\n");
rv = -1;
kfree(go->boot_fw);
go->boot_fw = NULL;
return -1;
}
return rv;
return 0;
}
MODULE_FIRMWARE("go7007/go7007fw.bin");