From 93e6a2f0b39e276db2181167f797e234fa8014a2 Mon Sep 17 00:00:00 2001 From: Shaurya Rane Date: Tue, 25 Nov 2025 22:24:29 +0530 Subject: [PATCH] media: radio-keene: fix memory leak in probe The usb_keene_probe() function allocates memory for the v4l2 control handler using v4l2_ctrl_handler_init(). However, if the probe fails later (e.g. in v4l2_device_register() or video_register_device()), this memory is never freed, leading to a leak. Fix this by adding v4l2_ctrl_handler_free() to the error path. Reported-by: syzbot+a41b73dce23962a74c72@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a41b73dce23962a74c72 Fixes: 1bf20c3a0c61 ("[media] radio-keene: add a driver for the Keene FM Transmitter") Signed-off-by: Shaurya Rane --- drivers/media/radio/radio-keene.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/radio/radio-keene.c b/drivers/media/radio/radio-keene.c index f3b57f0cb1ec..c133305fd019 100644 --- a/drivers/media/radio/radio-keene.c +++ b/drivers/media/radio/radio-keene.c @@ -338,7 +338,6 @@ static int usb_keene_probe(struct usb_interface *intf, if (hdl->error) { retval = hdl->error; - v4l2_ctrl_handler_free(hdl); goto err_v4l2; } retval = v4l2_device_register(&intf->dev, &radio->v4l2_dev); @@ -384,6 +383,7 @@ static int usb_keene_probe(struct usb_interface *intf, err_vdev: v4l2_device_unregister(&radio->v4l2_dev); err_v4l2: + v4l2_ctrl_handler_free(&radio->hdl); kfree(radio->buffer); kfree(radio); err: -- 2.34.1