2019-09-14 14:20:19

by Navid Emamdoost

Subject: [PATCH] media: usb: fix memory leak in af9005_identify_state

In af9005_identify_state when returning -EIO the allocated buffer should
be released.

Signed-off-by: Navid Emamdoost <[email protected]>
---
drivers/media/usb/dvb-usb/af9005.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/usb/dvb-usb/af9005.c b/drivers/media/usb/dvb-usb/af9005.c
index 02697d86e8c1..aee500beaab6 100644
--- a/drivers/media/usb/dvb-usb/af9005.c
+++ b/drivers/media/usb/dvb-usb/af9005.c
@@ -975,8 +975,10 @@ static int af9005_identify_state(struct usb_device *udev,
*cold = 1;
else if (reply == 0x02)
*cold = 0;
- else
+ else {
+ kfree(buf);
return -EIO;
+ }
deb_info("Identify state cold = %d\n", *cold);

err:
--
2.17.1

2019-10-09 12:43:16

by Hans Verkuil

Subject: Re: [PATCH] media: usb: fix memory leak in af9005_identify_state

On 9/14/19 1:55 AM, Navid Emamdoost wrote:
> In af9005_identify_state when returning -EIO the allocated buffer should
> be released.
>
> Signed-off-by: Navid Emamdoost <[email protected]>
> ---
> drivers/media/usb/dvb-usb/af9005.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/media/usb/dvb-usb/af9005.c b/drivers/media/usb/dvb-usb/af9005.c
> index 02697d86e8c1..aee500beaab6 100644
> --- a/drivers/media/usb/dvb-usb/af9005.c
> +++ b/drivers/media/usb/dvb-usb/af9005.c
> @@ -975,8 +975,10 @@ static int af9005_identify_state(struct usb_device *udev,
> *cold = 1;
> else if (reply == 0x02)
> *cold = 0;
> - else
> + else {
> + kfree(buf);
> return -EIO;
> + }

Why not just set ret = -EIO; here?

You only need to add a

if (!ret)
> deb_info("Identify state cold = %d\n", *cold);

before this line.

So this becomes:

else
ret = -EIO;
if (!ret)
deb_info("Identify state cold = %d\n", *cold);

Regards,

Hans

>
> err:
>

2019-10-09 15:02:10

by Navid Emamdoost

Subject: Re: [PATCH] media: usb: fix memory leak in af9005_identify_state

Hi Hans,

On Wed, Oct 9, 2019 at 7:42 AM Hans Verkuil <[email protected]> wrote:
>
> On 9/14/19 1:55 AM, Navid Emamdoost wrote:
> > In af9005_identify_state when returning -EIO the allocated buffer should
> > be released.
> >
> > Signed-off-by: Navid Emamdoost <[email protected]>
> > ---
> > drivers/media/usb/dvb-usb/af9005.c | 4 +++-
> > 1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/media/usb/dvb-usb/af9005.c b/drivers/media/usb/dvb-usb/af9005.c
> > index 02697d86e8c1..aee500beaab6 100644
> > --- a/drivers/media/usb/dvb-usb/af9005.c
> > +++ b/drivers/media/usb/dvb-usb/af9005.c
> > @@ -975,8 +975,10 @@ static int af9005_identify_state(struct usb_device *udev,
> > *cold = 1;
> > else if (reply == 0x02)
> > *cold = 0;
> > - else
> > + else {
> > + kfree(buf);
> > return -EIO;
> > + }
>
> Why not just set ret = -EIO; here?
>
This makes sense. I will send a v2.

> You only need to add a
>
> if (!ret)
> > deb_info("Identify state cold = %d\n", *cold);
>
> before this line.
>
> So this becomes:
>
> else
> ret = -EIO;
> if (!ret)
> deb_info("Identify state cold = %d\n", *cold);
>
> Regards,
>
> Hans
>
> >
> > err:
> >
>


--
Navid.

2019-10-09 15:03:43

by Navid Emamdoost

Subject: [PATCH v2] media: usb: fix memory leak in af9005_identify_state

In af9005_identify_state when returning -EIO the allocated buffer should
be released. Replace the "return -EIO" with assignment into ret and move
deb_info() under a check.

Fixes: af4e067e1dcf ("V4L/DVB (5625): Add support for the AF9005 demodulator from Afatech")
Signed-off-by: Navid Emamdoost <[email protected]>
---
Changes in v2:
-- Reused the error handling to release buf
-- Added Fixes tag
---
drivers/media/usb/dvb-usb/af9005.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/media/usb/dvb-usb/af9005.c b/drivers/media/usb/dvb-usb/af9005.c
index 02697d86e8c1..bc6e7659c37b 100644
--- a/drivers/media/usb/dvb-usb/af9005.c
+++ b/drivers/media/usb/dvb-usb/af9005.c
@@ -975,9 +975,10 @@ static int af9005_identify_state(struct usb_device *udev,
*cold = 1;
else if (reply == 0x02)
*cold = 0;
- else
- return -EIO;
- deb_info("Identify state cold = %d\n", *cold);
+ else
+ ret = -EIO;
+ if (!ret)
+ deb_info("Identify state cold = %d\n", *cold);

err:
kfree(buf);
--
2.17.1