diff options
| author | Zhipeng Lu <alexious@zju.edu.cn> | 2024-02-21 12:37:13 +0800 |
|---|---|---|
| committer | Hans Verkuil <hverkuil-cisco@xs4all.nl> | 2024-02-28 16:00:33 +0100 |
| commit | b9b683844b01d171a72b9c0419a2d760d946ee12 (patch) | |
| tree | 8229e976452a1cdb1507e7facd6aa7db8d279e84 /drivers/media | |
| parent | 7a4cf27d1f0538f779bf31b8c99eda394e277119 (diff) | |
| download | linux-b9b683844b01d171a72b9c0419a2d760d946ee12.tar.gz | |
media: go7007: fix a memleak in go7007_load_encoder
In go7007_load_encoder, bounce(i.e. go->boot_fw), is allocated without
a deallocation thereafter. After the following call chain:
saa7134_go7007_init
|-> go7007_boot_encoder
|-> go7007_load_encoder
|-> kfree(go)
go is freed and thus bounce is leaked.
Fixes: 95ef39403f89 ("[media] go7007: remember boot firmware")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Diffstat (limited to 'drivers/media')
| -rw-r--r-- | drivers/media/usb/go7007/go7007-driver.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/drivers/media/usb/go7007/go7007-driver.c b/drivers/media/usb/go7007/go7007-driver.c index 0c24e29843048..eb03f98b2ef11 100644 --- a/drivers/media/usb/go7007/go7007-driver.c +++ b/drivers/media/usb/go7007/go7007-driver.c @@ -80,7 +80,7 @@ static int go7007_load_encoder(struct go7007 *go) const struct firmware *fw_entry; char fw_name[] = "go7007/go7007fw.bin"; void *bounce; - int fw_len, rv = 0; + int fw_len; u16 intr_val, intr_data; if (go->boot_fw == NULL) { @@ -109,9 +109,11 @@ static int go7007_load_encoder(struct go7007 *go) go7007_read_interrupt(go, &intr_val, &intr_data) < 0 || (intr_val & ~0x1) != 0x5a5a) { v4l2_err(go, "error transferring firmware\n"); - rv = -1; + kfree(go->boot_fw); + go->boot_fw = NULL; + return -1; } - return rv; + return 0; } MODULE_FIRMWARE("go7007/go7007fw.bin"); |