For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: [PATCH] Fix memory leak in vidtv_psi_registration_desc_init
Author: michail.tatas@gmail.com
#syz test
Reported-by: syzbot+e9a1f5e196de6663631b@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=e9a1f5e196de6663631b
Signed-off-by: Michail Tatas <michail.tatas@gmail.com>
---
drivers/media/dvb-core/dmxdev.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
index 3c8bc75e4d6c..33502fdfdc61 100644
--- a/drivers/media/dvb-core/dmxdev.c
+++ b/drivers/media/dvb-core/dmxdev.c
@@ -884,6 +884,7 @@ static int dvb_dmxdev_add_pid(struct dmxdev *dmxdev,
struct dmxdev_filter *filter, u16 pid)
{
struct dmxdev_feed *feed;
+ int ret;
if ((filter->type != DMXDEV_TYPE_PES) ||
(filter->state < DMXDEV_STATE_SET))
@@ -901,8 +902,15 @@ static int dvb_dmxdev_add_pid(struct dmxdev *dmxdev,
feed->pid = pid;
list_add(&feed->next, &filter->feed.ts);
- if (filter->state >= DMXDEV_STATE_GO)
- return dvb_dmxdev_start_feed(dmxdev, filter, feed);
+ if (filter->state >= DMXDEV_STATE_GO) {
+ ret = dvb_dmxdev_start_feed(dmxdev, filter, feed);
+ if (ret < 0) {
+ list_del(&feed->next);
+ kfree(feed);
+ return ret;
+ }
+ }
+
return 0;
}
--
2.43.0