Received: by 2002:a05:6a10:1287:0:0:0:0 with SMTP id d7csp4159298pxv; Mon, 19 Jul 2021 18:49:33 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwtTFo1r0w6Pay6FvHbwM/Udui9Tq6SBvh5XqQ2vNgiQQSqGmjEiezP6Pt5IpeMj5fFCXXj X-Received: by 2002:a05:6402:17d3:: with SMTP id s19mr37668719edy.49.1626745772832; Mon, 19 Jul 2021 18:49:32 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1626745772; cv=none; d=google.com; s=arc-20160816; b=0weJvgB27QheqdDjCtBPu6gG5JaXZ7gaBIVBisWlW68ZCSYOZkvowOeKbfkDxsvr0z Y1mZBb3IpElmixuysCTTCJpY6WyWel2WhvVAs8JuU+LlrLfnchWf0qWvFTVDSmN6LZyy ckbxTqOfNP5oSyMnBdrxuQat5Y/i8NKiuQjBCH0T2G/uK9FLqBKiWyNDrj6QnbPZ5p0U WGjhmURzWR30FXOmxvUe3QUNjC4MZlmmAFyo6IPBeMFiHw0vzjAF8sIZfa4+2bHmb5+n wE2heVy8ieSBFTGE7QDjwL3FpyKu2A6puU4h9kogCgQ1yv3iTnUp7WUDy59v7zjAzT8M 900Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=bhJ98N8MQvYGc50l6dDXA5hKqwIcH/RzSljM3Zx9E6g=; b=JQcgKeyuhJHjiKlCPe3GKl72EFAWnGq0HdMaUHKRdEbCqoJEjRyOwPXuwT/+JdOqie XqxI5VWKrUze6t0v7P+rGfNaCszjjCBdHgFEQCQvtIvjXiR/AcMVIhDOhaGnvZIFhFWO 2cn0THyq3S+LxqgLBIaPzXi5gyAvemln11QU/DRrDiTl7QeyQ6If/JlaOAwEkLcKwK4N p7ExmKZ3hnqX0kjH+DSf0ph9RgUQevPQUXifjQQVLx7cC4PdPIlr2ZIQ3KvmOcQMHJ1Q GgR635+fnN64xiClPuCgXB9iSysFAHwCmwiI7KBfN3Cv/atnCsP8LgFgVlRwcKprVlB5 iT4g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=NE4kM4jj; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id bd21si16087625edb.593.2021.07.19.18.49.10; Mon, 19 Jul 2021 18:49:32 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=NE4kM4jj; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345431AbhGSPKk (ORCPT + 99 others); Mon, 19 Jul 2021 11:10:40 -0400 Received: from mail.kernel.org ([198.145.29.99]:40454 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343908AbhGSOsg (ORCPT ); Mon, 19 Jul 2021 10:48:36 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 40468611ED; Mon, 19 Jul 2021 15:25:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1626708301; bh=UvqcB2RdHS7wPhJdai6TqEUrKyA7NGhUEarctvUJSOg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NE4kM4jjkv9YKTpOX6ZztSRyyB5q2cchzJxsdzAmubQOpm3ZK/OS/EVahTFlJ+cWX hrV6z+iEq/T2lH3w4cfpVXQVXVSRSP1pGd4XPcqFJcL9X7OwCXAgtmXaK/fkVktoHV GMeO1WIqeLhGtL7ebup56RgEyw5cGxWr3fVlxI0g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+af4fa391ef18efdd5f69@syzkaller.appspotmail.com, Pavel Skripkin , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.14 224/315] media: zr364xx: fix memory leak in zr364xx_start_readpipe Date: Mon, 19 Jul 2021 16:51:53 +0200 Message-Id: <20210719144950.791865796@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210719144942.861561397@linuxfoundation.org> References: <20210719144942.861561397@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Pavel Skripkin commit 0a045eac8d0427b64577a24d74bb8347c905ac65 upstream. syzbot reported memory leak in zr364xx driver. The problem was in non-freed urb in case of usb_submit_urb() fail. backtrace: [] kmalloc include/linux/slab.h:561 [inline] [] usb_alloc_urb+0x66/0xe0 drivers/usb/core/urb.c:74 [] zr364xx_start_readpipe+0x78/0x130 drivers/media/usb/zr364xx/zr364xx.c:1022 [] zr364xx_board_init drivers/media/usb/zr364xx/zr364xx.c:1383 [inline] [] zr364xx_probe+0x6a3/0x851 drivers/media/usb/zr364xx/zr364xx.c:1516 [] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 [] really_probe+0x159/0x500 drivers/base/dd.c:576 Fixes: ccbf035ae5de ("V4L/DVB (12278): zr364xx: implement V4L2_CAP_STREAMING") Cc: stable@vger.kernel.org Reported-by: syzbot+af4fa391ef18efdd5f69@syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman --- drivers/media/usb/zr364xx/zr364xx.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/media/usb/zr364xx/zr364xx.c +++ b/drivers/media/usb/zr364xx/zr364xx.c @@ -1061,6 +1061,7 @@ static int zr364xx_start_readpipe(struct DBG("submitting URB %p\n", pipe_info->stream_urb); retval = usb_submit_urb(pipe_info->stream_urb, GFP_KERNEL); if (retval) { + usb_free_urb(pipe_info->stream_urb); printk(KERN_ERR KBUILD_MODNAME ": start read pipe failed\n"); return retval; }