linux-kernel - [PATCH] media: v4l2: Fix memleak in videobuf_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210105075904.27102-1-dinghao.liu@zju.edu.cn>
Date:   Tue,  5 Jan 2021 15:59:02 +0800
From:   Dinghao Liu <dinghao.liu@....edu.cn>
To:     dinghao.liu@....edu.cn, kjlu@....edu
Cc:     Mauro Carvalho Chehab <mchehab@...nel.org>,
        Laurent Dufour <ldufour@...ux.ibm.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        "Gustavo A. R. Silva" <gustavoars@...nel.org>,
        Vlastimil Babka <vbabka@...e.cz>,
        Michel Lespinasse <walken@...gle.com>,
        Ricardo Cerqueira <v4l@...queira.org>,
        linux-media@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH] media: v4l2: Fix memleak in videobuf_read_one

When videobuf_waiton() fails, we should execute clean
functions to prevent memleak. It's the same when
__videobuf_copy_to_user() fails.

Fixes: 7a7d9a89d0307 ("V4L/DVB (6251): Replace video-buf to a more generic approach")
Signed-off-by: Dinghao Liu <dinghao.liu@....edu.cn>
---
 drivers/media/v4l2-core/videobuf-core.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/media/v4l2-core/videobuf-core.c b/drivers/media/v4l2-core/videobuf-core.c
index 606a271bdd2d..0709b75d11cd 100644
--- a/drivers/media/v4l2-core/videobuf-core.c
+++ b/drivers/media/v4l2-core/videobuf-core.c
@@ -924,8 +924,12 @@ ssize_t videobuf_read_one(struct videobuf_queue *q,
 
 	/* wait until capture is done */
 	retval = videobuf_waiton(q, q->read_buf, nonblocking, 1);
-	if (0 != retval)
+	if (retval != 0) {
+		q->ops->buf_release(q, q->read_buf);
+		kfree(q->read_buf);
+		q->read_buf = NULL;
 		goto done;
+	}
 
 	CALL(q, sync, q, q->read_buf);
 
@@ -940,8 +944,12 @@ ssize_t videobuf_read_one(struct videobuf_queue *q,
 
 	/* Copy to userspace */
 	retval = __videobuf_copy_to_user(q, q->read_buf, data, count, nonblocking);
-	if (retval < 0)
+	if (retval < 0) {
+		q->ops->buf_release(q, q->read_buf);
+		kfree(q->read_buf);
+		q->read_buf = NULL;
 		goto done;
+	}
 
 	q->read_off += retval;
 	if (q->read_off == q->read_buf->size) {
-- 
2.17.1