From 0b4eb46c6f9f4dbf9dc9d9b07a5bc8b5ece04b8d Mon Sep 17 00:00:00 2001 From: Shaurya Rane Date: Wed, 26 Nov 2025 01:47:41 +0530 Subject: [PATCH] media: radio-keene: fix memory leak in error path Fix a memory leak in usb_keene_probe() when v4l2_device_register() fails. The v4l2 control handler was initialized and controls were added, but if v4l2_device_register() failed, the handler was never freed, leaking the allocated memory for the handler buckets and control structures. Consolidate the error handling by adding an err_hdl label that ensures v4l2_ctrl_handler_free() is called for all error paths after the handler is initialized. Reported-by: syzbot+a41b73dce23962a74c72@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a41b73dce23962a74c72 Fixes: fc39f46b8e82 ("[media] radio-keene: add a driver for the Keene FM Transmitter") Signed-off-by: Shaurya Rane --- drivers/media/radio/radio-keene.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/media/radio/radio-keene.c b/drivers/media/radio/radio-keene.c index f3b57f0cb1ec..84916b5ebcb2 100644 --- a/drivers/media/radio/radio-keene.c +++ b/drivers/media/radio/radio-keene.c @@ -337,14 +337,12 @@ static int usb_keene_probe(struct usb_interface *intf, radio->stereo = true; if (hdl->error) { retval = hdl->error; - - v4l2_ctrl_handler_free(hdl); - goto err_v4l2; + goto err_hdl; } retval = v4l2_device_register(&intf->dev, &radio->v4l2_dev); if (retval < 0) { dev_err(&intf->dev, "couldn't register v4l2_device\n"); - goto err_v4l2; + goto err_hdl; } mutex_init(&radio->lock); @@ -383,6 +381,8 @@ static int usb_keene_probe(struct usb_interface *intf, err_vdev: v4l2_device_unregister(&radio->v4l2_dev); +err_hdl: + v4l2_ctrl_handler_free(&radio->hdl); err_v4l2: kfree(radio->buffer); kfree(radio); -- 2.34.1