On Thu Apr 2 15:35:29 2026 +0800, Ma Ke wrote:
> In saa7134_video_init1(), the return value of the first
> saa7134_pgtable_alloc() is not checked. If it fails, the function
> continues as if successful, leaving the driver with an invalid page
> table. Additionally, if vb2_queue_init() for the VBI queue fails after
> the video queue page table has been allocated, the allocated memory is
> not freed before returning. The second saa7134_pgtable_alloc() also
> lacks a return value check. Errors occur during device probing before
> the device is fully registered, the normal cleanup path in
> saa7134_finidev() is not executed, leading to memory leaks and
> potential use of uninitialized DMA resources.
>
> Check the return value of both saa7134_pgtable_alloc() calls and
> propagate errors. On failure of any later step, free allocated page
> tables to avoid memory leaks. Ensure control handlers are also
> released on error to prevent further resource leakage.
>
> Found by code review.
>
> Signed-off-by: Ma Ke <[email protected]>
> Cc: [email protected]
> Fixes: a00e68888d5d ("[media] saa7134: move saa7134_pgtable to
> saa7134_dmaqueue")
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/pci/saa7134/saa7134-video.c | 25 ++++++++++++++++++++-----
1 file changed, 20 insertions(+), 5 deletions(-)
---
diff --git a/drivers/media/pci/saa7134/saa7134-video.c
b/drivers/media/pci/saa7134/saa7134-video.c
index 4a51b873e47a..2b1672737d84 100644
--- a/drivers/media/pci/saa7134/saa7134-video.c
+++ b/drivers/media/pci/saa7134/saa7134-video.c
@@ -1714,8 +1714,10 @@ int saa7134_video_init1(struct saa7134_dev *dev)
q->dev = &dev->pci->dev;
ret = vb2_queue_init(q);
if (ret)
- return ret;
- saa7134_pgtable_alloc(dev->pci, &dev->video_q.pt);
+ goto err_free_ctrl;
+ ret = saa7134_pgtable_alloc(dev->pci, &dev->video_q.pt);
+ if (ret)
+ goto err_free_ctrl;
q = &dev->vbi_vbq;
q->type = V4L2_BUF_TYPE_VBI_CAPTURE;
@@ -1732,11 +1734,24 @@ int saa7134_video_init1(struct saa7134_dev *dev)
q->lock = &dev->lock;
q->dev = &dev->pci->dev;
ret = vb2_queue_init(q);
- if (ret)
- return ret;
- saa7134_pgtable_alloc(dev->pci, &dev->vbi_q.pt);
+ if (ret) {
+ saa7134_pgtable_free(dev->pci, &dev->video_q.pt);
+ goto err_free_ctrl;
+ }
+
+ ret = saa7134_pgtable_alloc(dev->pci, &dev->vbi_q.pt);
+ if (ret) {
+ saa7134_pgtable_free(dev->pci, &dev->video_q.pt);
+ goto err_free_ctrl;
+ }
return 0;
+
+err_free_ctrl:
+ v4l2_ctrl_handler_free(&dev->ctrl_handler);
+ if (card_has_radio(dev))
+ v4l2_ctrl_handler_free(&dev->radio_ctrl_handler);
+ return ret;
}
void saa7134_video_fini(struct saa7134_dev *dev)
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
