Received: by 2002:a05:6a10:5bc5:0:0:0:0 with SMTP id os5csp1428750pxb; Wed, 20 Oct 2021 05:05:04 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyHfis9eLZ54KSfLOHx29VJVxbkYus0KbkhIaoYVtNEeBtnbtwkMNBuxm5HYAQjwf9ssGHh X-Received: by 2002:a05:6000:1362:: with SMTP id q2mr32193710wrz.44.1634731503799; Wed, 20 Oct 2021 05:05:03 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1634731503; cv=none; d=google.com; s=arc-20160816; b=lit+IBr6T8shMb7ZBQTKLLyjNjElfPu/QnTC1lXUuwzKdoAz4zO/o+OZ1ZzBER8j2T JN7F2TvujYaIqZNPj/Akq6wzFUU7T40ckwPov3g84QPqnzFiFlepVAtoPsivItuabPIQ MlWF/9Mxt8LTrzOCsdl5Vz+9yGAy8VthQK7QlJcbtiy07VpJDWgyyfVoVRPC9bv+p5Ek 81gjuxOLGwGsBn3SM4cxdviNkrBdLPM9FD7563AgXLSLN2sj5CIn9nBuSErNzhJXTHcI LRyn8l79g1N+4ZYo+9OBTVbNAOBH9gKrdQGD/JWELA9n7FGh35HYTDfjlVmUsAQnGAah WAzQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=w/LMUfJsN+v4q/8cJDL64+Oi6SM4/VNaW3zZ/ZD8olU=; b=S7Ialpp2tXcZkZq8tfbaWDvLm1abZLcqujdd32+Jr4Lb1npE5EkyEnblFQR2j7i3FZ xsnqUgUN8JEcaOVBku4NiKIZhNa1kJsHtrNfKw/JcRgnKXY1QK7ZZHCeBaYRYMADqHr3 qFKRE7Unx+hXm89nqZV5o4mTX6P1FwLvVi1oIYZDCNyHWE1Khlv8JWZmOhEJ9ZwNqLO7 CwRaBIvpGOrEwtpsnI4RcPlxMd77YA5K0ZUNppn8wk8rbxGZC38w91KrsfrZnzNXFezl 80aE1T3muw8YTpO8QpPpbccnqprjXDKk6DAk05IJD6mDQGCpVSz5hHNfxsK6uv13xPx1 3I8Q== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=huawei.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id w13si3169139edd.205.2021.10.20.05.04.35; Wed, 20 Oct 2021 05:05:03 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=huawei.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230137AbhJTMBi (ORCPT + 99 others); Wed, 20 Oct 2021 08:01:38 -0400 Received: from szxga02-in.huawei.com ([45.249.212.188]:25304 "EHLO szxga02-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229548AbhJTMBh (ORCPT ); Wed, 20 Oct 2021 08:01:37 -0400 Received: from dggemv704-chm.china.huawei.com (unknown [172.30.72.54]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4HZ8DR2WtCzcfdv; Wed, 20 Oct 2021 19:54:47 +0800 (CST) Received: from kwepemm600001.china.huawei.com (7.193.23.3) by dggemv704-chm.china.huawei.com (10.3.19.47) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.15; Wed, 20 Oct 2021 19:59:20 +0800 Received: from huawei.com (10.175.104.82) by kwepemm600001.china.huawei.com (7.193.23.3) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.15; Wed, 20 Oct 2021 19:59:20 +0800 From: Wang Hai To: , CC: , Subject: [PATCH] media: i2c: lm3560: Fix possible memory leak in lm3560_probe() Date: Wed, 20 Oct 2021 19:58:24 +0800 Message-ID: <20211020115824.2013778-1-wanghai38@huawei.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: 7BIT Content-Type: text/plain; charset=US-ASCII X-Originating-IP: [10.175.104.82] X-ClientProxiedBy: dggems702-chm.china.huawei.com (10.3.19.179) To kwepemm600001.china.huawei.com (7.193.23.3) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org In the error handling path of lm3560_probe(), ctrl handler allocated by lm3560_subdev_init() does not released, and caused memory leak as follows: unreferenced object 0xffff888257dbac10 (size 16): comm "35", pid 6061, jiffies 4299029793 (age 201.830s) hex dump (first 16 bytes): 40 06 ff 0c 81 88 ff ff 40 24 ff 0c 81 88 ff ff @.......@$...... backtrace: [] slab_post_alloc_hook+0x9c/0x490 [] __kmalloc_node+0x16b/0x3a0 [] kvmalloc_node+0x4f/0xf0 [] v4l2_ctrl_handler_init_class+0xf9/0x160 [] lm3560_subdev_init+0x120/0x340 [lm3560] [] lm3560_probe+0x17c/0x370 [lm3560] [] i2c_device_probe+0x5d3/0x600 [] really_probe+0x190/0x480 [] __driver_probe_device+0xf9/0x180 [] driver_probe_device+0x53/0x130 [] __device_attach_driver+0x105/0x130 [] bus_for_each_drv+0x129/0x190 [] __device_attach+0x1c9/0x270 [] device_initial_probe+0x20/0x30 [] bus_probe_device+0x142/0x160 [] device_add+0x829/0x1300 unreferenced object 0xffff888255118100 (size 256): Fix the error handling path to avoid memory leak. Fixes: 7f6b11a18c30 ("[media] media: i2c: add driver for dual LED Flash, lm3560") Reported-by: Hulk Robot Signed-off-by: Wang Hai --- drivers/media/i2c/lm3560.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/media/i2c/lm3560.c b/drivers/media/i2c/lm3560.c index 9e34ccce4fc3..8bd60b14b867 100644 --- a/drivers/media/i2c/lm3560.c +++ b/drivers/media/i2c/lm3560.c @@ -432,15 +432,22 @@ static int lm3560_probe(struct i2c_client *client, rval = lm3560_subdev_init(flash, LM3560_LED1, "lm3560-led1"); if (rval < 0) - return rval; + goto err_subdev_init_led1; rval = lm3560_init_device(flash); if (rval < 0) - return rval; + goto err_init_device; i2c_set_clientdata(client, flash); return 0; + +err_init_device: + v4l2_ctrl_handler_free(&flash->ctrls_led[LM3560_LED1]); +err_subdev_init_led1: + v4l2_ctrl_handler_free(&flash->ctrls_led[LM3560_LED0]); + + return rval; } static int lm3560_remove(struct i2c_client *client) -- 2.25.1