Hi! On Sat, 2021-03-27 at 11:01 +0200, Andy Shevchenko wrote: > > > On Saturday, March 27, 2021, Pavel Skripkin <paskripkin@xxxxxxxxx> > wrote: > > syzbot reported memory leak in em28xx_dvb_init()[1] > > The problem was in wrong error handling after > > em28xx_alloc_urbs()[2] > > call. > > In case of error allocated urbs must be freed > > > > > > I believe you may reduce twice the below backtrace and leave only > important line(s). Ok, I'll send new patch version soon. Thank you! > > > > backtrace: > > [<ffffffff8304c141>] kmalloc_array.constprop.0+0x41/0x60 > > include/linux/slab.h:594 > > [<ffffffff8304dba2>] kcalloc include/linux/slab.h:623 [inline] > > [<ffffffff8304dba2>] em28xx_alloc_urbs+0x102/0x550 > > drivers/media/usb/em28xx/em28xx-core.c:930 [2] > > [<ffffffff84279fa7>] em28xx_dvb_init > > drivers/media/usb/em28xx/em28xx-dvb.c:1517 [inline] [1] > > [<ffffffff84279fa7>] em28xx_dvb_init.cold+0xa3/0x2bb1 > > drivers/media/usb/em28xx/em28xx-dvb.c:1483 > > [<ffffffff8304e33b>] em28xx_init_extension+0x9b/0xe0 > > drivers/media/usb/em28xx/em28xx-core.c:1126 > > [<ffffffff83050143>] request_module_async+0x33/0x40 > > drivers/media/usb/em28xx/em28xx-cards.c:3406 > > [<ffffffff81259229>] process_one_work+0x2c9/0x600 > > kernel/workqueue.c:2275 > > [<ffffffff81259dbb>] process_scheduled_works > > kernel/workqueue.c:2337 [inline] > > [<ffffffff81259dbb>] worker_thread+0x2fb/0x5d0 > > kernel/workqueue.c:2426 > > [<ffffffff81261228>] kthread+0x178/0x1b0 kernel/kthread.c:292 > > [<ffffffff8100227f>] ret_from_fork+0x1f/0x30 > > arch/x86/entry/entry_64.S:294 > > > > Reported-by: syzbot+889397c820fa56adf25d@xxxxxxxxxxxxxxxxxxxxxxxxx > > Signed-off-by: Pavel Skripkin <paskripkin@xxxxxxxxx> > > --- > > drivers/media/usb/em28xx/em28xx-dvb.c | 1 + > > 1 file changed, 1 insertion(+) > > > > diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c > > b/drivers/media/usb/em28xx/em28xx-dvb.c > > index 526424279637..471bd74667e3 100644 > > --- a/drivers/media/usb/em28xx/em28xx-dvb.c > > +++ b/drivers/media/usb/em28xx/em28xx-dvb.c > > @@ -2010,6 +2010,7 @@ static int em28xx_dvb_init(struct em28xx > > *dev) > > return result; > > > > out_free: > > + em28xx_uninit_usb_xfer(dev, EM28XX_DIGITAL_MODE); > > kfree(dvb); > > dev->dvb = NULL; > > goto ret; > > -- > > 2.30.2 > > > > > > -- With regards, Pavel Skripkin
