On Thu Nov 27 00:34:10 2025 +0530, Shaurya Rane wrote:
> Fix a memory leak in usb_keene_probe(). The v4l2 control handler is
> initialized and controls are added, but if v4l2_device_register() or
> video_register_device() fails afterward, the handler was never freed,
> leaking memory.
>
> Add v4l2_ctrl_handler_free() call in the err_v4l2 error path to ensure
> the control handler is properly freed for all error paths after it is
> initialized.
>
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=a41b73dce23962a74c72
> Fixes: 1bf20c3a0c61 ("[media] radio-keene: add a driver for the Keene FM
> Transmitter")
> Cc: [email protected]
> Signed-off-by: Shaurya Rane <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/radio/radio-keene.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
---
diff --git a/drivers/media/radio/radio-keene.c
b/drivers/media/radio/radio-keene.c
index f3b57f0cb1ec..c133305fd019 100644
--- a/drivers/media/radio/radio-keene.c
+++ b/drivers/media/radio/radio-keene.c
@@ -338,7 +338,6 @@ static int usb_keene_probe(struct usb_interface *intf,
if (hdl->error) {
retval = hdl->error;
- v4l2_ctrl_handler_free(hdl);
goto err_v4l2;
}
retval = v4l2_device_register(&intf->dev, &radio->v4l2_dev);
@@ -384,6 +383,7 @@ static int usb_keene_probe(struct usb_interface *intf,
err_vdev:
v4l2_device_unregister(&radio->v4l2_dev);
err_v4l2:
+ v4l2_ctrl_handler_free(&radio->hdl);
kfree(radio->buffer);
kfree(radio);
err:
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
