This is a note to let you know that I've just added the patch titled media: dvb-usb: Fix memory leak at error in dvb_usb_device_init() to the 5.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: media-dvb-usb-fix-memory-leak-at-error-in-dvb_usb_device_init.patch and it can be found in the queue-5.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 13a79f14ab285120bc4977e00a7c731e8143f548 Mon Sep 17 00:00:00 2001 From: Takashi Iwai <tiwai@xxxxxxx> Date: Mon, 1 Feb 2021 09:32:46 +0100 Subject: media: dvb-usb: Fix memory leak at error in dvb_usb_device_init() From: Takashi Iwai <tiwai@xxxxxxx> commit 13a79f14ab285120bc4977e00a7c731e8143f548 upstream. dvb_usb_device_init() allocates a dvb_usb_device object, but it doesn't release the object by itself even at errors. The object is released in the callee side (dvb_usb_init()) in some error cases via dvb_usb_exit() call, but it also missed the object free in other error paths. And, the caller (it's only dvb_usb_device_init()) doesn't seem caring the resource management as well, hence those memories are leaked. This patch assures releasing the memory at the error path in dvb_usb_device_init(). Now dvb_usb_init() frees the resources it allocated but leaves the passed dvb_usb_device object intact. In turn, the dvb_usb_device object is released in dvb_usb_device_init() instead. We could use dvb_usb_exit() function for releasing everything in the callee (as it was used for some error cases in the original code), but releasing the passed object in the callee is non-intuitive and error-prone. So I took this approach (which is more standard in Linus kernel code) although it ended with a bit more open codes. Along with the change, the patch makes sure that USB intfdata is reset and don't return the bogus pointer to the caller of dvb_usb_device_init() at the error path, too. Cc: <stable@xxxxxxxxxxxxxxx> Signed-off-by: Takashi Iwai <tiwai@xxxxxxx> Signed-off-by: Sean Young <sean@xxxxxxxx> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/media/usb/dvb-usb/dvb-usb-init.c | 47 ++++++++++++++++++++----------- 1 file changed, 31 insertions(+), 16 deletions(-) --- a/drivers/media/usb/dvb-usb/dvb-usb-init.c +++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c @@ -170,22 +170,20 @@ static int dvb_usb_init(struct dvb_usb_d if (d->props.priv_init != NULL) { ret = d->props.priv_init(d); - if (ret != 0) { - kfree(d->priv); - d->priv = NULL; - return ret; - } + if (ret != 0) + goto err_priv_init; } } /* check the capabilities and set appropriate variables */ dvb_usb_device_power_ctrl(d, 1); - if ((ret = dvb_usb_i2c_init(d)) || - (ret = dvb_usb_adapter_init(d, adapter_nums))) { - dvb_usb_exit(d); - return ret; - } + ret = dvb_usb_i2c_init(d); + if (ret) + goto err_i2c_init; + ret = dvb_usb_adapter_init(d, adapter_nums); + if (ret) + goto err_adapter_init; if ((ret = dvb_usb_remote_init(d))) err("could not initialize remote control."); @@ -193,6 +191,17 @@ static int dvb_usb_init(struct dvb_usb_d dvb_usb_device_power_ctrl(d, 0); return 0; + +err_adapter_init: + dvb_usb_adapter_exit(d); +err_i2c_init: + dvb_usb_i2c_exit(d); + if (d->priv && d->props.priv_destroy) + d->props.priv_destroy(d); +err_priv_init: + kfree(d->priv); + d->priv = NULL; + return ret; } /* determine the name and the state of the just found USB device */ @@ -296,15 +305,21 @@ int dvb_usb_device_init(struct usb_inter usb_set_intfdata(intf, d); - if (du != NULL) + ret = dvb_usb_init(d, adapter_nums); + if (ret) { + info("%s error while loading driver (%d)", desc->name, ret); + goto error; + } + + if (du) *du = d; - ret = dvb_usb_init(d, adapter_nums); + info("%s successfully initialized and connected.", desc->name); + return 0; - if (ret == 0) - info("%s successfully initialized and connected.", desc->name); - else - info("%s error while loading driver (%d)", desc->name, ret); + error: + usb_set_intfdata(intf, NULL); + kfree(d); return ret; } EXPORT_SYMBOL(dvb_usb_device_init); Patches currently in stable-queue which might be from tiwai@xxxxxxx are queue-5.4/alsa-hda-realtek-ga503-use-same-quirks-as-ga401.patch queue-5.4/alsa-usb-audio-more-constifications.patch queue-5.4/alsa-emu8000-fix-a-use-after-free-in-snd_emu8000_create_mixer.patch queue-5.4/alsa-hda-realtek-fix-mic-boost-on-intel-nuc-8.patch queue-5.4/media-dvb-usb-fix-use-after-free-access.patch queue-5.4/alsa-hda-realtek-add-quirk-for-intel-clevo-pcx0dx.patch queue-5.4/alsa-hda-realtek-fix-static-noise-on-alc285-lenovo-laptops.patch queue-5.4/alsa-sb-fix-two-use-after-free-in-snd_sb_qsound_build.patch queue-5.4/alsa-usb-audio-add-db-range-mapping-for-sennheiser-communications-headset-pc-8.patch queue-5.4/alsa-hda-conexant-re-order-cx5066-quirk-table-entries.patch queue-5.4/media-dvb-usb-fix-memory-leak-at-error-in-dvb_usb_device_init.patch queue-5.4/alsa-usb-audio-explicitly-set-up-the-clock-selector.patch