From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6465543D503; Thu, 30 Jul 2026 14:44:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785422659; cv=none; b=aqTYZWiQ31aBGZ8orElYnuYUCreirZ56ZEpFVoD3Kq4uLEsZtPQaVdIzJg7Hi3aOSUZ+NUU9p9yMTU1jPXzcFnUMXyLjOfZmSMnWCpT9pr4U4Vzdaqr/PoGgiTOXAfy9V0jlgBid/mUEg1ZetoBY6441mH07VrlRlhQuM9Ph8JI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785422659; c=relaxed/simple; bh=w6QckIuFn0UH8FlY1w9QVKb3gTegdLoDTWJ8kgF/Pg4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hKGvoyNFfVsKuyyLAcvn/Z8CqaWMbdO1wz9dri1roe1VFJa3cq+PLR/ETKZtYrdbjaE4/er0QWQtaxkyfNaLGJBLAJJJ1DgSBIKzR0lx4TinnsJZvzYpnODsr0M/DtDCFcnD755HlIj2Tyk1lNNWRMtm/QQrt2JHYra8Vmr3Fsc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=qI+mxNE5; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="qI+mxNE5" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B91811F00A3A; Thu, 30 Jul 2026 14:44:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1785422658; bh=EAn2TBiscOQblLSLBkpGOPBXJKsjP6ftoDOFtK5A3Hg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=qI+mxNE55TxKXIz79016rsaDvaqFcZ9a/rWf6kJ4+RLWl55HqdnbqJEWmU7FN+bMC CXpK5vKYhq1KU+voVA9alHs993bgE//AezsRIX2LQJVNKsABmqacIuoCTFqveob9fQ nxl9Jbd8ZmJB3Dn03y2FsbUL87hwSAaAW/FGn8BQ= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Ma Ke , Hans Verkuil Subject: [PATCH 7.1 515/744] media: saa7134: Fix a possible memory leak in saa7134_video_init1 Date: Thu, 30 Jul 2026 16:13:08 +0200 Message-ID: <20260730141455.224600220@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260730141444.267951807@linuxfoundation.org> References: <20260730141444.267951807@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ma Ke commit f86ed548386e3050e5f8f25b450d09dc009d9a88 upstream. In saa7134_video_init1(), the return value of the first saa7134_pgtable_alloc() is not checked. If it fails, the function continues as if successful, leaving the driver with an invalid page table. Additionally, if vb2_queue_init() for the VBI queue fails after the video queue page table has been allocated, the allocated memory is not freed before returning. The second saa7134_pgtable_alloc() also lacks a return value check. Errors occur during device probing before the device is fully registered, the normal cleanup path in saa7134_finidev() is not executed, leading to memory leaks and potential use of uninitialized DMA resources. Check the return value of both saa7134_pgtable_alloc() calls and propagate errors. On failure of any later step, free allocated page tables to avoid memory leaks. Ensure control handlers are also released on error to prevent further resource leakage. Found by code review. Signed-off-by: Ma Ke Cc: stable@vger.kernel.org Fixes: a00e68888d5d ("[media] saa7134: move saa7134_pgtable to saa7134_dmaqueue") Signed-off-by: Hans Verkuil Signed-off-by: Greg Kroah-Hartman --- drivers/media/pci/saa7134/saa7134-video.c | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) --- a/drivers/media/pci/saa7134/saa7134-video.c +++ b/drivers/media/pci/saa7134/saa7134-video.c @@ -1714,8 +1714,10 @@ int saa7134_video_init1(struct saa7134_d q->dev = &dev->pci->dev; ret = vb2_queue_init(q); if (ret) - return ret; - saa7134_pgtable_alloc(dev->pci, &dev->video_q.pt); + goto err_free_ctrl; + ret = saa7134_pgtable_alloc(dev->pci, &dev->video_q.pt); + if (ret) + goto err_free_ctrl; q = &dev->vbi_vbq; q->type = V4L2_BUF_TYPE_VBI_CAPTURE; @@ -1732,11 +1734,24 @@ int saa7134_video_init1(struct saa7134_d q->lock = &dev->lock; q->dev = &dev->pci->dev; ret = vb2_queue_init(q); - if (ret) - return ret; - saa7134_pgtable_alloc(dev->pci, &dev->vbi_q.pt); + if (ret) { + saa7134_pgtable_free(dev->pci, &dev->video_q.pt); + goto err_free_ctrl; + } + + ret = saa7134_pgtable_alloc(dev->pci, &dev->vbi_q.pt); + if (ret) { + saa7134_pgtable_free(dev->pci, &dev->video_q.pt); + goto err_free_ctrl; + } return 0; + +err_free_ctrl: + v4l2_ctrl_handler_free(&dev->ctrl_handler); + if (card_has_radio(dev)) + v4l2_ctrl_handler_free(&dev->radio_ctrl_handler); + return ret; } void saa7134_video_fini(struct saa7134_dev *dev)