linux-kernel - [PATCH] media: staging: davinci: fix for memory leak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Tue, 17 Sep 2019 18:02:38 -0500
From:   Navid Emamdoost <navid.emamdoost@...il.com>
To:     unlisted-recipients:; (no To-header on input)
Cc:     emamd001@....edu, smccaman@....edu, kjlu@....edu,
        Navid Emamdoost <navid.emamdoost@...il.com>,
        Mauro Carvalho Chehab <mchehab@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Irenge Jules Bashizi <jbi.octave@...il.com>,
        Ioannis Valasakis <code@...ofe.uk>,
        Mamta Shukla <mamtashukla555@...il.com>,
        Christophe JAILLET <christophe.jaillet@...adoo.fr>,
        Colin Ian King <colin.king@...onical.com>,
        Michelle Darcy <mdarcy137@...il.com>,
        Madhumitha Prabakaran <madhumithabiw@...il.com>,
        linux-media@...r.kernel.org, devel@...verdev.osuosl.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH] media: staging: davinci: fix for memory leak

In ipipe_g_config the allocated memory for params needs to be released
if either module_if->get or copy_to_user fails.

Signed-off-by: Navid Emamdoost <navid.emamdoost@...il.com>
---
 drivers/staging/media/davinci_vpfe/dm365_ipipe.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/media/davinci_vpfe/dm365_ipipe.c b/drivers/staging/media/davinci_vpfe/dm365_ipipe.c
index 52397ad0e3e2..3023691b53c0 100644
--- a/drivers/staging/media/davinci_vpfe/dm365_ipipe.c
+++ b/drivers/staging/media/davinci_vpfe/dm365_ipipe.c
@@ -1316,10 +1316,13 @@ static int ipipe_g_config(struct v4l2_subdev *sd, struct vpfe_ipipe_config *cfg)
 
 		if (to && from && size) {
 			rval = module_if->get(ipipe, from);
-			if (rval)
+			if (rval) {
+				kfree(params);
 				goto error;
+			}
 			if (copy_to_user((void __user *)to, from, size)) {
 				rval = -EFAULT;
+				kfree(params);
 				break;
 			}
 		}
-- 
2.17.1