From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A4159480321 for ; Tue, 14 Jul 2026 14:11:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784038282; cv=none; b=qy5YTqc6AAkA2GqW6vae0ozODlSE6zqLbHytQV2P3C7Asm2c0YUY3A3l2+2yUMUtCrI4tTX+A5yTXKfqk6+iLDNiyFjRO20TN76QtRSCcqWwVYC1zTjA1EJZeFxRMKxf9j2ZIXIeUz9zYdjFlGk9KOyiOwfy7KXwnqe1he4f4e0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784038282; c=relaxed/simple; bh=OwybD2uBs/wUrm5i2CpQEyB7SgIl3ZP7n2YWpoD4BkY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=NqBzDGz7HIJWqTka998MTAblXvd5CqJopbPjPucoZl5+OiNgo5OT+F75fMZeCEb5UD+5vVp8l390MeJI9+Qih1xsuWmnkExt9jI+Bx0r+YkPiDUPgEnqKrQa61JRzPBLvpOru/J5KXTVDdccnCIA+YnkSrFBRLkUizpjQnl5ZqE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=qKo++IFT; arc=none smtp.client-ip=209.85.128.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="qKo++IFT" Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-493b1710405so23305005e9.2 for ; Tue, 14 Jul 2026 07:11:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784038276; x=1784643076; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=57DmToGB+ZEdZKgwoyVbvaECYpm5bszrCqHLiqk8iao=; b=qKo++IFTqnShGZ9oW41ktxlLp1k3YppTCJc4SVnWMAkYDdgmY0UtiQLFCZ87vEQmpU 3cTpQQDjwX72Y3saESP4L6mic2bXfJ0v9HIpY8MYsEg4kqNNw7yUswU9Gashdy5X319U UNKlAAXyWZJZDvIACh7bCGS1bESlbXIJx326IbXriM3K9rD8fSlgloP0idItFWqATGhb Le6RL3HyHD2C5CvNSiEM7CpmBNKx/0WQcL0qHEsdQbU70bloxHlWNRiRrUcJUJzyhOF0 GNSnsJRyCnyrh2MyH4MP+qV9hxSXLxUJUoT9tlFpr1R053uOjpShQrxVk6lfLC5dkCtl HIoQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784038276; x=1784643076; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=57DmToGB+ZEdZKgwoyVbvaECYpm5bszrCqHLiqk8iao=; b=Hofo5u4TQ1d/A7UJA8EBkl7s5zP4+8EYHAh8EqF6Ch4UX1H0hoTG006/uq4deEaEY8 pMyZB9PA5QwWi2rDVfKJmOUzWWkfOS35sFvFy7csH1oMqAFVDnhTyMVvZcbREIMm3RVN EFdwqb9aHt5kr1ZZFiJOzFKSoquDQhgtg5brirh42mmx7vO43b2qz+cYX5ZyPaQ7kdYQ zWpwDbuS9V28xiVtWFrT4iDk2bPSnggINAiPPxkpgUh++n5xidFH3jrHV2Hl7bk8q34K G18qbW4UoCPDoIWzBKVSYwrKQsRfomhHMJG2K4CHjRa7ppw2+QQgPTY/Dzwa3ONRUwU8 00RA== X-Forwarded-Encrypted: i=1; AHgh+Rq0CAGcVVA0SzDHvmLApAizpWWuWrfmN0T+u3j0ag3aO9JA1knOPkjmUkHaU76mTkwlKkyYFlQngjoyj70=@vger.kernel.org X-Gm-Message-State: AOJu0Yx9wQSMLdlpE/npBy6gvz33n8YqipYo/ndwKh1CUbdIj3LFDfzB shP0mZVhxd5pW7aolSBioqlJAlGXalGE7xAHXoQt5amKBEY8Cf9icO2p X-Gm-Gg: AfdE7cmK0rma9KqHP3SkzUDFQtVdQwaYSyP68iN1Llx37ewMQSQ40HXOpCoHnyuXzfV BUo3fx8HSVUpUDb7ju5ji8jZQ/hnCft0ARLmMH/kWnAVqbIJ9ZA3+TUXaz3zkUxwTzeC3pxED+d tHhXWdwDb1EKIoeay29PniQsdJsn43kmnCdPHUQtDYSIB3khwa5AwuRtU/BUKdf++BukWNSGRX2 0UZkmpC//JX/nC5ZR3Sv/m4dbLBQVRBo35DcEuAsieJXq62hKsCh7bza/XUVG4X8dN3VPn4zG7E z7BoJvOdyZ+CQP5KNAzvZWjdxh1AxEZVtubfHthxxG9G++pPRJR89WWaGg/9k/TPFF26I0z1lfm QTfHVNeW94ATbT5wC+WIF9x1DqzxVpRwnSDHTE4EG79YCL4j6783IWSOBUm9f5+ndea4o90dqPl EKHgA0ZqPZoAYoMRucmnIn0YExuUc9NjwdrZXBIEWTuBQ1GovnuzQw9FM+tdX+c90j+4UZWcd4a q2z5kM31pTvY8zVEFbEbXr+jZRLxMtg7+A139rzRD07JSgVmDEa/rzLpWCoyf2B4LSCDXvM2g== X-Received: by 2002:a05:600c:2e55:b0:493:e365:7630 with SMTP id 5b1f17b1804b1-495158d666emr25042895e9.14.1784038275934; Tue, 14 Jul 2026 07:11:15 -0700 (PDT) Received: from localhost.localdomain (p200300fcd7032080f4b140b3d1b24071.dip0.t-ipconnect.de. [2003:fc:d703:2080:f4b1:40b3:d1b2:4071]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4950a2ed840sm73686275e9.10.2026.07.14.07.11.15 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Tue, 14 Jul 2026 07:11:15 -0700 (PDT) From: Rituparna Warwatkar To: Mauro Carvalho Chehab Cc: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Rituparna Warwatkar , syzbot+e9a1f5e196de6663631b@syzkaller.appspotmail.com Subject: [PATCH] media: dvb-core: fix feed leak on failed DMX_ADD_PID Date: Tue, 14 Jul 2026 16:10:59 +0200 Message-ID: <20260714141059.63582-1-rwarwatkar@gmail.com> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit dvb_dmxdev_add_pid() allocates a new dmxdev_feed, links it into filter->feed.ts and, when the filter is already running, immediately starts the feed. If starting the feed fails, the newly allocated feed remains on the list. Subsequent restart and rollback paths may then operate on this stale entry, leaving feed resources allocated and causing leaks in drivers that allocate resources from ->start_feed() and release them from ->stop_feed(). Remove the feed from the list and free it when dvb_dmxdev_start_feed() fails. Reported-by: syzbot+e9a1f5e196de6663631b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e9a1f5e196de6663631b Signed-off-by: Rituparna Warwatkar --- drivers/media/dvb-core/dmxdev.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c index 3c8bc75e4d6..6a825d9bae4 100644 --- a/drivers/media/dvb-core/dmxdev.c +++ b/drivers/media/dvb-core/dmxdev.c @@ -884,6 +884,7 @@ static int dvb_dmxdev_add_pid(struct dmxdev *dmxdev, struct dmxdev_filter *filter, u16 pid) { struct dmxdev_feed *feed; + int ret; if ((filter->type != DMXDEV_TYPE_PES) || (filter->state < DMXDEV_STATE_SET)) @@ -901,8 +902,14 @@ static int dvb_dmxdev_add_pid(struct dmxdev *dmxdev, feed->pid = pid; list_add(&feed->next, &filter->feed.ts); - if (filter->state >= DMXDEV_STATE_GO) - return dvb_dmxdev_start_feed(dmxdev, filter, feed); + if (filter->state >= DMXDEV_STATE_GO) { + ret = dvb_dmxdev_start_feed(dmxdev, filter, feed); + if (ret < 0) { + list_del(&feed->next); + kfree(feed); + return ret; + } + } return 0; } -- 2.47.3