diff options
| author | Sakari Ailus <sakari.ailus@linux.intel.com> | 2020-12-19 23:29:58 +0100 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab+huawei@kernel.org> | 2021-01-12 17:06:16 +0100 |
| commit | fb18802a338b36f675a388fc03d2aa504a0d0899 (patch) | |
| tree | ffa8ce23a4fd2f4122bcf1cbb9ec38241f4743fe /include/linux/debugobjects.h | |
| parent | f7c7d6ccc503c0a5f4e5debb570b55bf2eb24c73 (diff) | |
| download | cachepc-linux-fb18802a338b36f675a388fc03d2aa504a0d0899.tar.gz cachepc-linux-fb18802a338b36f675a388fc03d2aa504a0d0899.zip | |
media: v4l: ioctl: Fix memory leak in video_usercopy
When an IOCTL with argument size larger than 128 that also used array
arguments were handled, two memory allocations were made but alas, only
the latter one of them was released. This happened because there was only
a single local variable to hold such a temporary allocation.
Fix this by adding separate variables to hold the pointers to the
temporary allocations.
Reported-by: Arnd Bergmann <arnd@kernel.org>
Reported-by: syzbot+1115e79c8df6472c612b@syzkaller.appspotmail.com
Fixes: d14e6d76ebf7 ("[media] v4l: Add multi-planar ioctl handling code")
Cc: stable@vger.kernel.org
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Diffstat (limited to 'include/linux/debugobjects.h')
0 files changed, 0 insertions, 0 deletions