Message ID | 20220811045701.31152-1-dzm91@hust.edu.cn (mailing list archive) |
---|---|
State | New, archived |
Headers | show |
Series | media: airspy: fix memory leak in airspy probe | expand |
Hi Dongliang, On Thu, Aug 11, 2022 at 12:57:00PM +0800, Dongliang Mu wrote: > From: Dongliang Mu <mudongliangabcd@gmail.com> > > The commit ca9dc8d06ab6 ("media: airspy: respect the DMA coherency > rules") moves variable buf from stack to heap, however, it only frees > buf in the error handling code, missing deallocation in the success > path. > > Fix this by freeing buf in the success path since this variable does not > have any references in other code. > > Fixes: ca9dc8d06ab6 ("media: airspy: respect the DMA coherency rules") > Reported-by: syzbot+bb25f85e5aa482864dc0@syzkaller.appspotmail.com > Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com> > --- > drivers/media/usb/airspy/airspy.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/drivers/media/usb/airspy/airspy.c b/drivers/media/usb/airspy/airspy.c > index 240a7cc56777..7b1c40132555 100644 > --- a/drivers/media/usb/airspy/airspy.c > +++ b/drivers/media/usb/airspy/airspy.c > @@ -1070,6 +1070,10 @@ static int airspy_probe(struct usb_interface *intf, > ret); > goto err_free_controls; > } > + > + /* Free buf if success*/ > + kfree(buf); > + buf var is only used to print the fw version during the probe. I think you are right we need to free this. Reviewed-by: Tommaso Merciai <tommaso.merciai@amarulasolution.com> > dev_info(s->dev, "Registered as %s\n", > video_device_node_name(&s->vdev)); > dev_notice(s->dev, "SDR API is still slightly experimental and functionality changes may follow\n"); > -- > 2.35.1 > Regards, Tommaso
diff --git a/drivers/media/usb/airspy/airspy.c b/drivers/media/usb/airspy/airspy.c index 240a7cc56777..7b1c40132555 100644 --- a/drivers/media/usb/airspy/airspy.c +++ b/drivers/media/usb/airspy/airspy.c @@ -1070,6 +1070,10 @@ static int airspy_probe(struct usb_interface *intf, ret); goto err_free_controls; } + + /* Free buf if success*/ + kfree(buf); + dev_info(s->dev, "Registered as %s\n", video_device_node_name(&s->vdev)); dev_notice(s->dev, "SDR API is still slightly experimental and functionality changes may follow\n");