lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

media: go7007: fix a memleak in go7007_load_encoder

Browse Source 
[ Upstream commit b9b683844b01d171a72b9c0419a2d760d946ee12 ]

In go7007_load_encoder, bounce(i.e. go->boot_fw), is allocated without
a deallocation thereafter. After the following call chain:

saa7134_go7007_init
  |-> go7007_boot_encoder
        |-> go7007_load_encoder
  |-> kfree(go)

go is freed and thus bounce is leaked.

Fixes: 95ef39403f ("[media] go7007: remember boot firmware")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Zhipeng Lu 2024-02-21 12:37:13 +08:00 committed by Sasha Levin
parent fa8b472952
commit 291cda0b80
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/media/usb/go7007/go7007-driver.c
View File

@ -80,7 +80,7 @@ static int go7007_load_encoder(struct go7007 *go)
const struct firmware *fw_entry; const struct firmware *fw_entry;
char fw_name[] = "go7007/go7007fw.bin"; char fw_name[] = "go7007/go7007fw.bin";
void *bounce; void *bounce;
int fw_len, rv = 0; int fw_len;
u16 intr_val, intr_data; u16 intr_val, intr_data;
if (go->boot_fw == NULL) { if (go->boot_fw == NULL) {
@ -109,9 +109,11 @@ static int go7007_load_encoder(struct go7007 *go)
go7007_read_interrupt(go, &intr_val, &intr_data) < 0 || go7007_read_interrupt(go, &intr_val, &intr_data) < 0 ||
(intr_val & ~0x1) != 0x5a5a) { (intr_val & ~0x1) != 0x5a5a) {
v4l2_err(go, "error transferring firmware\n"); v4l2_err(go, "error transferring firmware\n");
rv = -1; kfree(go->boot_fw);
go->boot_fw = NULL;
return -1;
} }
return rv; return 0;
} }
MODULE_FIRMWARE("go7007/go7007fw.bin"); MODULE_FIRMWARE("go7007/go7007fw.bin");