On Tue Jul 14 16:10:59 2026 +0200, Rituparna Warwatkar wrote:
> dvb_dmxdev_add_pid() allocates a new dmxdev_feed, links it into
> filter->feed.ts and, when the filter is already running, immediately
> starts the feed.
>
> If starting the feed fails, the newly allocated feed remains on the
> list. Subsequent restart and rollback paths may then operate on this
> stale entry, leaving feed resources allocated and causing leaks in
> drivers that allocate resources from ->start_feed() and release them
> from ->stop_feed().
>
> Remove the feed from the list and free it when
> dvb_dmxdev_start_feed() fails.
>
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=e9a1f5e196de6663631b
> Signed-off-by: Rituparna Warwatkar <[email protected]>
> Link: https://patch.msgid.link/[email protected]
> Signed-off-by: Mauro Carvalho Chehab <[email protected]>
> Message-ID: <[email protected]>
Patch committed.
Thanks,
Mauro Carvalho Chehab
drivers/media/dvb-core/dmxdev.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
---
diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
index 3c8bc75e4d6c..6a825d9bae43 100644
--- a/drivers/media/dvb-core/dmxdev.c
+++ b/drivers/media/dvb-core/dmxdev.c
@@ -884,6 +884,7 @@ static int dvb_dmxdev_add_pid(struct dmxdev *dmxdev,
struct dmxdev_filter *filter, u16 pid)
{
struct dmxdev_feed *feed;
+ int ret;
if ((filter->type != DMXDEV_TYPE_PES) ||
(filter->state < DMXDEV_STATE_SET))
@@ -901,8 +902,14 @@ static int dvb_dmxdev_add_pid(struct dmxdev *dmxdev,
feed->pid = pid;
list_add(&feed->next, &filter->feed.ts);
- if (filter->state >= DMXDEV_STATE_GO)
- return dvb_dmxdev_start_feed(dmxdev, filter, feed);
+ if (filter->state >= DMXDEV_STATE_GO) {
+ ret = dvb_dmxdev_start_feed(dmxdev, filter, feed);
+ if (ret < 0) {
+ list_del(&feed->next);
+ kfree(feed);
+ return ret;
+ }
+ }
return 0;
}
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
