[PATCH] Fix memory leak in vidtv_psi_registration_desc_init

[Michail Tatas]

#syz test

Reported-by: syzbot+e9a1f5...@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=e9a1f5e196de6663631b
Signed-off-by: Michail Tatas <michai...@gmail.com>
---
drivers/media/dvb-core/dmxdev.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
index 3c8bc75e4d6c..33502fdfdc61 100644
--- a/drivers/media/dvb-core/dmxdev.c
+++ b/drivers/media/dvb-core/dmxdev.c
@@ -884,6 +884,7 @@ static int dvb_dmxdev_add_pid(struct dmxdev *dmxdev,
struct dmxdev_filter *filter, u16 pid)
{
struct dmxdev_feed *feed;
+ int ret;

if ((filter->type != DMXDEV_TYPE_PES) ||
(filter->state < DMXDEV_STATE_SET))
@@ -901,8 +902,15 @@ static int dvb_dmxdev_add_pid(struct dmxdev *dmxdev,
feed->pid = pid;
list_add(&feed->next, &filter->feed.ts);

- if (filter->state >= DMXDEV_STATE_GO)
- return dvb_dmxdev_start_feed(dmxdev, filter, feed);
+ if (filter->state >= DMXDEV_STATE_GO) {
+ ret = dvb_dmxdev_start_feed(dmxdev, filter, feed);
+ if (ret < 0) {
+ list_del(&feed->next);
+ kfree(feed);
+ return ret;
+ }
+ }
+

return 0;
}
--
2.43.0

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+e9a1f5...@syzkaller.appspotmail.com
Tested-by: syzbot+e9a1f5...@syzkaller.appspotmail.com

Tested on:

commit: 3b029c03 Merge tag 'cgroup-for-7.2-rc3-fixes' of git:/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=112d18b9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=b80376788da8bcda
dashboard link: https://syzkaller.appspot.com/bug?extid=e9a1f5e196de6663631b
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch: https://syzkaller.appspot.com/x/patch.diff?x=11f2f432580000

Note: testing is done by a robot and is best-effort only.