From nobody Mon Jun 8 21:46:49 2026 Received: from mail-oo1-f71.google.com (mail-oo1-f71.google.com [209.85.161.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4ED9D39733E for ; Tue, 26 May 2026 10:04:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.71 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779789883; cv=none; b=I++g2Ns+Pz2LukBoL3XPk9ooiElNDxqgFPXUIw61MdjMDOkonc+Ph64ufk3JbNy0Gn8JTMAJHoqyLq/VYOdDXO6DjUeR2oT6OOA9nVsSjpjVqVH0uyrV4dYwJV5kiD3uN3RZeu9MIHpCWYNuBoCX9QEishlAigw/2UKqWP7zb/k= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779789883; c=relaxed/simple; bh=sEqm/IwaFmz2f2CQwlkREuNhK/iLzAnKiej+U/mlGe0=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=l2Gx+ySzBrhIeegoCAGFuBbIXjlyTZP3Hqn4myuLFTu75Ik5yS/BKZ7lixzutrMOeZ0jbfXwQuAWWBnuojIQGfWoDkErwMHk12imPXrGFSto/3VJ3kG9QR1J8WuA/4q7C5TCproeNIS6JrlruMDToVDo7nkV3smrvTh1mkc9b1g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.161.71 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oo1-f71.google.com with SMTP id 006d021491bc7-69d6b83becaso6947046eaf.2 for ; Tue, 26 May 2026 03:04:42 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779789881; x=1780394681; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=4YQaMFeirrLTWnHhzq7/2/NB+XC2FhQlCtGO6QVq7ug=; b=kw5kdmcpmOBfTVWhYtwMiZDxIUbBCfd2/VcjMBZDWhbVVDoeYAcNkUuS+KDQIxGlhT d1WuajXWnbJKCpvAUJGNNDr0BmMLLeGpm0CsFY3kT0m2icnaaatFz7x5HhHwLAt8ZYWy ZVINUN/8IUH6BV/9XLyjLGkvr7EWT78T3Ze1qwCeVDcRtaJv37D1dwoxRq+9LlUduT9S G5i4NZzDXPfIQOqbLJPgYvgkv9PFoIpjYIfFlDxREr+zgU8PBPtXVizNwccYZFXIWO1N 1XHZ678AW1V/ZcTz4KnS53fkv2ItQHeK5g1Z/9/erNK3So3TNaOqOmDq1mB8QoEqKwMw ISWA== X-Gm-Message-State: AOJu0YxHt1OEiIi4jb7zppg/hFoNEqbfUsCUjXEOMevoHxMvYkUjON86 37pyED1rooMmFvuu4N2TiqcdfPuuaVDo/i6Lg8oS76qXQKnJBQAMeOMeHuyFqc7mEfaLzHh5A33 bhBBvqg5PDTospuKPIdUiojFJsOMEert30ckhIhWBrsubrK13Qyn2gxubnLg= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:6ac2:b0:69b:3a37:7896 with SMTP id 006d021491bc7-69d7eca690emr10160726eaf.50.1779789881396; Tue, 26 May 2026 03:04:41 -0700 (PDT) Date: Tue, 26 May 2026 03:04:41 -0700 In-Reply-To: <6a150a33.2b0a0220.185dbd.0004.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6a157039.170a0220.22ae77.0015.GAE@google.com> Subject: Forwarded: [PATCH 1/2] media: vidtv: fix memory leak in vidtv_psi_desc_clone() on allocation failure From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: [PATCH 1/2] media: vidtv: fix memory leak in vidtv_psi_desc_clone(= ) on allocation failure Author: zhanghaotian@uniontech.com #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git= master vidtv_psi_desc_clone() builds a linked list of cloned descriptors by calling descriptor init functions (e.g. vidtv_psi_service_desc_init()) that chain new entries into the accumulated "head" via vidtv_psi_desc_chain(). When any init function or kmemdup() fails inside the while loop, the function returns NULL without freeing the already-built portion of head, leaking memory. Fix this by calling vidtv_psi_desc_destroy(head) before returning NULL in both failure paths. Reported-by: syzbot+acc3b75c010446ad403f@syzkaller.appspotmail.com Signed-off-by: zhanghaotian --- drivers/media/test-drivers/vidtv/vidtv_psi.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/media/test-drivers/vidtv/vidtv_psi.c b/drivers/media/t= est-drivers/vidtv/vidtv_psi.c index 1b6225d65..7f38011ae 100644 --- a/drivers/media/test-drivers/vidtv/vidtv_psi.c +++ b/drivers/media/test-drivers/vidtv/vidtv_psi.c @@ -481,11 +481,11 @@ struct vidtv_psi_desc *vidtv_psi_desc_clone(struct vi= dtv_psi_desc *desc) default: curr =3D kmemdup(desc, sizeof(*desc) + desc->length, GFP_KERNEL); if (!curr) - return NULL; + goto free_head; } =20 if (!curr) - return NULL; + goto free_head; =20 curr->next =3D NULL; if (!head) @@ -498,6 +498,10 @@ struct vidtv_psi_desc *vidtv_psi_desc_clone(struct vid= tv_psi_desc *desc) } =20 return head; + +free_head: + vidtv_psi_desc_destroy(head); + return NULL; } =20 void vidtv_psi_desc_destroy(struct vidtv_psi_desc *desc) --=20 2.30.2