On Mon, Nov 01, 2021 at 05:55:39PM +0800, Dongliang Mu wrote:
> In the em28xx_init_rev, if em28xx_audio_setup fails, this function fails
> to deallocate the media_dev allocated in the em28xx_media_device_init.
>
> Fix this by adding em28xx_unregister_media_device to free media_dev.
>
> BTW, this patch is tested in my local syzkaller instance, and it can
> prevent the memory leak from occurring again.
>
> CC: Pavel Skripkin <paskripkin@xxxxxxxxx>
> Fixes: 37ecc7b1278f ("[media] em28xx: add media controller support")
> Signed-off-by: Dongliang Mu <mudongliangabcd@xxxxxxxxx>
> Reported-by: syzbot <syzkaller@xxxxxxxxxxxxxxxx>
Is this really a syzbot warning? If so it should be in the format:
Reported-by: syzbot+4c4ffd1e1094dae61035@xxxxxxxxxxxxxxxxxxxxxxxxx
Syzbot is different from syzkaller. Syzkaller is the fuzzer and syzbot
is the program which reports syzkaller bugs.
> ---
> drivers/media/usb/em28xx/em28xx-cards.c | 19 +++++++++++++------
> 1 file changed, 13 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
> index c1e0dccb7408..fca68939ca50 100644
> --- a/drivers/media/usb/em28xx/em28xx-cards.c
> +++ b/drivers/media/usb/em28xx/em28xx-cards.c
> @@ -3625,8 +3625,10 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,
>
There is no check to see if the em28xx_media_device_init() fails. I
don't love that we call unregister() to undo the init() but it seems
like it should work...
> if (dev->is_audio_only) {
> retval = em28xx_audio_setup(dev);
> - if (retval)
> - return -ENODEV;
> + if (retval) {
> + retval = -ENODEV;
This was in the original code, but probably we should preserve the
error code.
> + goto err_deinit_media;
> + }
regards,
dan carpenter
