| Message ID | 20250416205121.2348-1-Dm1tryNk@yandex.ru |
|---|---|
| State | New |
| Headers | show |
| Series | [v3] media: davinci: vpif: Fix memory leak in probe error path | expand |
On Wed, Apr 16, 2025 at 11:51:19PM +0300, Dmitry Nikiforov wrote: > If an error occurs during the initialization of `pdev_display`, > the allocated platform device `pdev_capture` is not released properly, > leading to a memory leak. > > Adjust error path handling to fix the leak. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: 43acb728bbc4 ("media: davinci: vpif: fix use-after-free on driver unbind") > Signed-off-by: Dmitry Nikiforov <Dm1tryNk@yandex.ru> > --- > v2: also fix of_graph_get_endpoint_by_regs() error path. > v3: Rework incorrect error handling added in v2. > Also fix missing platform_device_del() in another error path (Johan Hovold). Thanks for the update. Looks good: Reviewed-by: Johan Hovold <johan@kernel.org>
diff --git a/drivers/media/platform/ti/davinci/vpif.c b/drivers/media/platform/ti/davinci/vpif.c index a81719702a22..969d623fc842 100644 --- a/drivers/media/platform/ti/davinci/vpif.c +++ b/drivers/media/platform/ti/davinci/vpif.c @@ -504,7 +504,7 @@ static int vpif_probe(struct platform_device *pdev) pdev_display = kzalloc(sizeof(*pdev_display), GFP_KERNEL); if (!pdev_display) { ret = -ENOMEM; - goto err_put_pdev_capture; + goto err_del_pdev_capture; } pdev_display->name = "vpif_display"; @@ -527,6 +527,8 @@ static int vpif_probe(struct platform_device *pdev) err_put_pdev_display: platform_device_put(pdev_display); +err_del_pdev_capture: + platform_device_del(pdev_capture); err_put_pdev_capture: platform_device_put(pdev_capture); err_put_rpm:
If an error occurs during the initialization of `pdev_display`, the allocated platform device `pdev_capture` is not released properly, leading to a memory leak. Adjust error path handling to fix the leak. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 43acb728bbc4 ("media: davinci: vpif: fix use-after-free on driver unbind") Signed-off-by: Dmitry Nikiforov <Dm1tryNk@yandex.ru> --- v2: also fix of_graph_get_endpoint_by_regs() error path. v3: Rework incorrect error handling added in v2. Also fix missing platform_device_del() in another error path (Johan Hovold). drivers/media/platform/ti/davinci/vpif.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)