From nobody Fri Oct 17 10:31:36 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DEDEDC433FE for ; Wed, 19 Oct 2022 09:22:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233453AbiJSJW3 (ORCPT ); Wed, 19 Oct 2022 05:22:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57734 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233420AbiJSJVZ (ORCPT ); Wed, 19 Oct 2022 05:21:25 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E6D4D3C16F; Wed, 19 Oct 2022 02:09:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id F143261807; Wed, 19 Oct 2022 09:01:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 12F0EC433D6; Wed, 19 Oct 2022 09:01:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666170088; bh=9IY8itcj0UntKkJNFI/Iu3RvzWtyhrIob2EbC+YLLxs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ifqvi3Te3cGp3CQx6+NZ1Oao+aiG4jhHPvNmy7U44XpeLQIZnmRkgSbuKc1Wg7AW6 IBProP9Uc5CWOe9o+CEz98Pq3P0eYcxnrzzle1AH0Ec8maYyDuVtB5a0NH7ASMLV7/ ubcu2u7QzaIF+hIk3iPE41blr57xEyU2Jkoy11I0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+bb25f85e5aa482864dc0@syzkaller.appspotmail.com, Dongliang Mu , Tommaso Merciai , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 6.0 486/862] media: airspy: fix memory leak in airspy probe Date: Wed, 19 Oct 2022 10:29:33 +0200 Message-Id: <20221019083311.448540730@linuxfoundation.org> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20221019083249.951566199@linuxfoundation.org> References: <20221019083249.951566199@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dongliang Mu [ Upstream commit 23bc5eb55f8c9607965c20d9ddcc13cb1ae59568 ] The commit ca9dc8d06ab6 ("media: airspy: respect the DMA coherency rules") moves variable buf from stack to heap, however, it only frees buf in the error handling code, missing deallocation in the success path. Fix this by freeing buf in the success path since this variable does not have any references in other code. Fixes: ca9dc8d06ab6 ("media: airspy: respect the DMA coherency rules") Reported-by: syzbot+bb25f85e5aa482864dc0@syzkaller.appspotmail.com Signed-off-by: Dongliang Mu Reviewed-by: Tommaso Merciai Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin --- drivers/media/usb/airspy/airspy.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/media/usb/airspy/airspy.c b/drivers/media/usb/airspy/a= irspy.c index 240a7cc56777..7b1c40132555 100644 --- a/drivers/media/usb/airspy/airspy.c +++ b/drivers/media/usb/airspy/airspy.c @@ -1070,6 +1070,10 @@ static int airspy_probe(struct usb_interface *intf, ret); goto err_free_controls; } + + /* Free buf if success*/ + kfree(buf); + dev_info(s->dev, "Registered as %s\n", video_device_node_name(&s->vdev)); dev_notice(s->dev, "SDR API is still slightly experimental and functional= ity changes may follow\n"); --=20 2.35.1