• Pavel Skripkin's avatar
    media: dvb-usb: fix memory leak in dvb_usb_adapter_init · b7cd0da9
    Pavel Skripkin authored
    syzbot reported memory leak in dvb-usb. The problem was
    in invalid error handling in dvb_usb_adapter_init().
    
    for (n = 0; n < d->props.num_adapters; n++) {
    ....
    	if ((ret = dvb_usb_adapter_stream_init(adap)) ||
    		(ret = dvb_usb_adapter_dvb_init(adap, adapter_nrs)) ||
    		(ret = dvb_usb_adapter_frontend_init(adap))) {
    		return ret;
    	}
    ...
    	d->num_adapters_initialized++;
    ...
    }
    
    In case of error in dvb_usb_adapter_dvb_init() or
    dvb_usb_adapter_dvb_init() d->num_adapters_initialized won't be
    incremented, but dvb_usb_adapter_exit() relies on it:
    
    	for (n = 0; n < d->num_adapters_initialized; n++)
    
    So, allocated objects won't be freed.
    Signed-off-by: default avatarPavel Skripkin <paskripkin@gmail.com>
    Reported-by: syzbot+3c2be7424cea3b932b0e@syzkaller.appspotmail.com
    Signed-off-by: default avatarSean Young <sean@mess.org>
    Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
    b7cd0da9
dvb-usb-init.c 9.53 KB