Patch "media: i2c: ov772x: Fix memleak in ov772x_probe()" has been added to the 6.2-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    media: i2c: ov772x: Fix memleak in ov772x_probe()

to the 6.2-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     media-i2c-ov772x-fix-memleak-in-ov772x_probe.patch
and it can be found in the queue-6.2 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 128e37ff02125528a2a30fcee84b7e5275d41064
Author: Yuan Can <yuancan@xxxxxxxxxx>
Date:   Thu Dec 8 09:06:25 2022 +0100

    media: i2c: ov772x: Fix memleak in ov772x_probe()
    
    [ Upstream commit 7485edb2b6ca5960205c0a49bedfd09bba30e521 ]
    
    A memory leak was reported when testing ov772x with bpf mock device:
    
    AssertionError: unreferenced object 0xffff888109afa7a8 (size 8):
      comm "python3", pid 279, jiffies 4294805921 (age 20.681s)
      hex dump (first 8 bytes):
        80 22 88 15 81 88 ff ff                          ."......
      backtrace:
        [<000000009990b438>] __kmalloc_node+0x44/0x1b0
        [<000000009e32f7d7>] kvmalloc_node+0x34/0x180
        [<00000000faf48134>] v4l2_ctrl_handler_init_class+0x11d/0x180 [videodev]
        [<00000000da376937>] ov772x_probe+0x1c3/0x68c [ov772x]
        [<000000003f0d225e>] i2c_device_probe+0x28d/0x680
        [<00000000e0b6db89>] really_probe+0x17c/0x3f0
        [<000000001b19fcee>] __driver_probe_device+0xe3/0x170
        [<0000000048370519>] driver_probe_device+0x49/0x120
        [<000000005ead07a0>] __device_attach_driver+0xf7/0x150
        [<0000000043f452b8>] bus_for_each_drv+0x114/0x180
        [<00000000358e5596>] __device_attach+0x1e5/0x2d0
        [<0000000043f83c5d>] bus_probe_device+0x126/0x140
        [<00000000ee0f3046>] device_add+0x810/0x1130
        [<00000000e0278184>] i2c_new_client_device+0x359/0x4f0
        [<0000000070baf34f>] of_i2c_register_device+0xf1/0x110
        [<00000000a9f2159d>] of_i2c_notify+0x100/0x160
    unreferenced object 0xffff888119825c00 (size 256):
      comm "python3", pid 279, jiffies 4294805921 (age 20.681s)
      hex dump (first 32 bytes):
        00 b4 a5 17 81 88 ff ff 00 5e 82 19 81 88 ff ff  .........^......
        10 5c 82 19 81 88 ff ff 10 5c 82 19 81 88 ff ff  .\.......\......
      backtrace:
        [<000000009990b438>] __kmalloc_node+0x44/0x1b0
        [<000000009e32f7d7>] kvmalloc_node+0x34/0x180
        [<0000000073d88e0b>] v4l2_ctrl_new.cold+0x19b/0x86f [videodev]
        [<00000000b1f576fb>] v4l2_ctrl_new_std+0x16f/0x210 [videodev]
        [<00000000caf7ac99>] ov772x_probe+0x1fa/0x68c [ov772x]
        [<000000003f0d225e>] i2c_device_probe+0x28d/0x680
        [<00000000e0b6db89>] really_probe+0x17c/0x3f0
        [<000000001b19fcee>] __driver_probe_device+0xe3/0x170
        [<0000000048370519>] driver_probe_device+0x49/0x120
        [<000000005ead07a0>] __device_attach_driver+0xf7/0x150
        [<0000000043f452b8>] bus_for_each_drv+0x114/0x180
        [<00000000358e5596>] __device_attach+0x1e5/0x2d0
        [<0000000043f83c5d>] bus_probe_device+0x126/0x140
        [<00000000ee0f3046>] device_add+0x810/0x1130
        [<00000000e0278184>] i2c_new_client_device+0x359/0x4f0
        [<0000000070baf34f>] of_i2c_register_device+0xf1/0x110
    
    The reason is that if priv->hdl.error is set, ov772x_probe() jumps to the
    error_mutex_destroy without doing v4l2_ctrl_handler_free(), and all
    resources allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std()
    are leaked.
    
    Fixes: 1112babde214 ("media: i2c: Copy ov772x soc_camera sensor driver")
    Signed-off-by: Yuan Can <yuancan@xxxxxxxxxx>
    Reviewed-by: Laurent Pinchart <laurent.pinchart@xxxxxxxxxxxxxxxx>
    Signed-off-by: Sakari Ailus <sakari.ailus@xxxxxxxxxxxxxxx>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/media/i2c/ov772x.c b/drivers/media/i2c/ov772x.c
index 4189e3fc3d535..a238e63425f8c 100644
--- a/drivers/media/i2c/ov772x.c
+++ b/drivers/media/i2c/ov772x.c
@@ -1462,7 +1462,7 @@ static int ov772x_probe(struct i2c_client *client)
 	priv->subdev.ctrl_handler = &priv->hdl;
 	if (priv->hdl.error) {
 		ret = priv->hdl.error;
-		goto error_mutex_destroy;
+		goto error_ctrl_free;
 	}
 
 	priv->clk = clk_get(&client->dev, NULL);
@@ -1515,7 +1515,6 @@ static int ov772x_probe(struct i2c_client *client)
 	clk_put(priv->clk);
 error_ctrl_free:
 	v4l2_ctrl_handler_free(&priv->hdl);
-error_mutex_destroy:
 	mutex_destroy(&priv->lock);
 
 	return ret;



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux