Re: [PATCH] media: em28xx: Fix possible memory leak of em28xx struct

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 





On 5/3/21 5:06 PM, Shuah Khan wrote:
Hi Igor,

On 5/3/21 11:37 AM, Igor Matheus Andrade Torrente wrote:
The em28xx struct kref isn't being decreased after an error in the
em28xx_ir_init, leading to a possible memory leak.

A kref_put is added to the error handler code.

Signed-off-by: Igor Matheus Andrade Torrente <igormtorrente@xxxxxxxxx>
---
  drivers/media/usb/em28xx/em28xx-input.c | 7 +++++--
  1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/em28xx/em28xx-input.c b/drivers/media/usb/em28xx/em28xx-input.c
index 5aa15a7a49de..b89527014cad 100644
--- a/drivers/media/usb/em28xx/em28xx-input.c
+++ b/drivers/media/usb/em28xx/em28xx-input.c
@@ -720,7 +720,8 @@ static int em28xx_ir_init(struct em28xx *dev)
              dev->board.has_ir_i2c = 0;
              dev_warn(&dev->intf->dev,
                   "No i2c IR remote control device found.\n");
-            return -ENODEV;
+            err = -ENODEV;
+            goto ref_put;

This doesn't look right. em28xx_init_buttons() is already happened and
em28xx_shutdown_buttons() needs to be done from fini. fini needs to run
with this ref. If ref is released here, device might be released before
em28xx_shutdown_buttons() can run leading to potential use-after-free


Thanks for the feedback.

I sent a patch V2 that I think fix the problem pointed out.

          }
      }
@@ -735,7 +736,7 @@ static int em28xx_ir_init(struct em28xx *dev)
      ir = kzalloc(sizeof(*ir), GFP_KERNEL);
      if (!ir)
-        return -ENOMEM;
+        goto ref_put;

This doesn't look right. Same comment as above. fini accounts for null
ir.

       em28xx_shutdown_buttons(dev);

        /* skip detach on non attached boards */
        if (!ir)
                goto ref_put;


      rc = rc_allocate_device(RC_DRIVER_SCANCODE);
      if (!rc)
          goto error;
@@ -839,6 +840,8 @@ static int em28xx_ir_init(struct em28xx *dev)
      dev->ir = NULL;
      rc_free_device(rc);
      kfree(ir);
+ref_put:
+    kref_put(&dev->ref, em28xx_free_device);
      return err;
  }


thanks,
-- Shuah

Best regard,
---
Igor M. A. Torrente



[Index of Archives]     [Linux Input]     [Video for Linux]     [Gstreamer Embedded]     [Mplayer Users]     [Linux USB Devel]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]

  Powered by Linux