提交 901db397 编写于 作者: Y Yang Yingliang 提交者: Zheng Zengkai

media: si470x-i2c: fix possible memory leak in si470x_i2c_probe()

stable inclusion
from stable-v5.10.94
commit 2028fb832da623e66ec78af9fc366088f6177bb9
bugzilla: https://gitee.com/openeuler/kernel/issues/I531X9

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2028fb832da623e66ec78af9fc366088f6177bb9

--------------------------------

[ Upstream commit ef054e34 ]

n the 'radio->hdl.error' error handling, ctrl handler allocated by
v4l2_ctrl_new_std() does not released, and caused memory leak as
follows:

unreferenced object 0xffff888033d54200 (size 256):
  comm "i2c-si470x-19", pid 909, jiffies 4294914203 (age 8.072s)
  hex dump (first 32 bytes):
    e8 69 11 03 80 88 ff ff 00 46 d5 33 80 88 ff ff  .i.......F.3....
    10 42 d5 33 80 88 ff ff 10 42 d5 33 80 88 ff ff  .B.3.....B.3....
  backtrace:
    [<00000000086bd4ed>] __kmalloc_node+0x1eb/0x360
    [<00000000bdb68871>] kvmalloc_node+0x66/0x120
    [<00000000fac74e4c>] v4l2_ctrl_new+0x7b9/0x1c60 [videodev]
    [<00000000693bf940>] v4l2_ctrl_new_std+0x19b/0x270 [videodev]
    [<00000000c0cb91bc>] si470x_i2c_probe+0x2d3/0x9a0 [radio_si470x_i2c]
    [<0000000056a6f01f>] i2c_device_probe+0x4d8/0xbe0

Fix the error handling path to avoid memory leak.
Reported-by: NHulk Robot <hulkci@huawei.com>
Fixes: 8c081b6f ("media: radio: Critical v4l2 registration...")
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: NHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: NMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Acked-by: NXie XiuQi <xiexiuqi@huawei.com>
上级 033b2c6e
...@@ -368,7 +368,7 @@ static int si470x_i2c_probe(struct i2c_client *client) ...@@ -368,7 +368,7 @@ static int si470x_i2c_probe(struct i2c_client *client)
if (radio->hdl.error) { if (radio->hdl.error) {
retval = radio->hdl.error; retval = radio->hdl.error;
dev_err(&client->dev, "couldn't register control\n"); dev_err(&client->dev, "couldn't register control\n");
goto err_dev; goto err_all;
} }
/* video device initialization */ /* video device initialization */
...@@ -463,7 +463,6 @@ static int si470x_i2c_probe(struct i2c_client *client) ...@@ -463,7 +463,6 @@ static int si470x_i2c_probe(struct i2c_client *client)
return 0; return 0;
err_all: err_all:
v4l2_ctrl_handler_free(&radio->hdl); v4l2_ctrl_handler_free(&radio->hdl);
err_dev:
v4l2_device_unregister(&radio->v4l2_dev); v4l2_device_unregister(&radio->v4l2_dev);
err_initial: err_initial:
return retval; return retval;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册