linux-kernel - Re: [PATCH v2] media: radio-keene: fix memory leak in error path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <tm5swq4u2t4lkvbk7b6qt3mstecmvypspbbbjir6pyha7ao52w@7g2ychpstnv6>
Date: Wed, 26 Nov 2025 23:16:28 +0530
From: Abdun Nihaal <abdun.nihaal@...il.com>
To: ssrane_b23@...vjti.ac.in
Cc: Hans Verkuil <hverkuil@...nel.org>, 
	Mauro Carvalho Chehab <mchehab@...nel.org>, linux-media@...r.kernel.org, linux-kernel@...r.kernel.org, 
	skhan@...uxfoundation.org, linux-kernel-mentees@...ts.linux.dev, 
	david.hunter.linux@...il.com, khalid@...nel.org, 
	syzbot+a41b73dce23962a74c72@...kaller.appspotmail.com
Subject: Re: [PATCH v2] media: radio-keene: fix memory leak in error path

On Wed, Nov 26, 2025 at 12:00:00PM +0530, ssrane_b23@...vjti.ac.in wrote:
> Fix a memory leak in usb_keene_probe() when v4l2_device_register()
> fails. The v4l2 control handler was initialized and controls were
> added, but if v4l2_device_register() failed, the handler was never
> freed, leaking the allocated memory for the handler buckets and
> control structures.
> 
> Consolidate the error handling by adding an err_hdl label that
> ensures v4l2_ctrl_handler_free() is called for all error paths
> after the handler is initialized.
> 
> ---
> v2:
>   - Simplified fix: call v4l2_ctrl_handler_free() inline before goto
>     instead of adding a new error label, avoiding unused label warning
>     reported by Media CI.

v4l2_ctrl_handler_free() has to be called in the last error path also
(the one after the v4l2_device_register() call).

Your v1 patch was correct and also better because it avoided repeated
calls to v4l2_ctrl_handler_free() in different error paths.

To fix the unused label warning just use err_v4l2 itself instead of
introducing err_hdl, because both error path that goes to err_v4l2
needs to call v4l2_ctrl_handler_free() to fix the memory leak.

Regards,
Nihaal