Forwarded: [PATCH] media: vidtv: psi: fix memory leak when a section exceeds the max length

[syzbot <syzbot+597f53f8e81b2f87620c@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] media: vidtv: psi: fix memory leak when a section exceeds the max length
Author: godanaemiru@gmail.com

#syz test
vidtv_psi_pat_program_assign(), vidtv_psi_sdt_service_assign() and
vidtv_psi_eit_event_assign() take ownership of the list they are passed
and store it in the table.

All three retry when the resulting section grows past the maximum
section length: the local pointer is set to NULL and the loop body runs
again, storing NULL in the table. The list the table was holding is
dropped without ever being freed, so every entry on it leaks. kmemleak
reports the pat_program and sdt_service entries allocated by
vidtv_channel_si_init() when this happens.

Free the list the table currently owns before overwriting the pointer.
On the first assignment the table holds no list and the destroy helpers
ignore a NULL argument, so this only has an effect on the retry
iteration and on any later re-assignment, both of which previously
leaked.

Reported-by: syzbot+597f53f8e81b2f87620c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=597f53f8e81b2f87620c
Fixes: f90cf6079bf6 ("media: vidtv: add a bridge driver")
Signed-off-by: Godana Emiru <godanaemiru@gmail.com>
---
 drivers/media/test-drivers/vidtv/vidtv_psi.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/media/test-drivers/vidtv/vidtv_psi.c b/drivers/media/test-drivers/vidtv/vidtv_psi.c
index 1b6225d65..0970c0cdc 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_psi.c
+++ b/drivers/media/test-drivers/vidtv/vidtv_psi.c
@@ -893,6 +893,9 @@ vidtv_psi_pat_program_assign(struct vidtv_psi_table_pat *pat,
 			program = program->next;
 		}
 
+		/* The table owns the list, so free the one being replaced */
+		vidtv_psi_pat_program_destroy(pat->program);
+
 		pat->num_pat = program_count;
 		pat->program  = p;
 
@@ -1432,6 +1435,9 @@ vidtv_psi_sdt_service_assign(struct vidtv_psi_table_sdt *sdt,
 		if (service == sdt->service)
 			return;
 
+		/* The table owns the list, so free the one being replaced */
+		vidtv_psi_sdt_service_destroy(sdt->service);
+
 		sdt->service = service;
 
 		/* recompute section length */
@@ -1781,6 +1787,9 @@ void vidtv_psi_eit_event_assign(struct vidtv_psi_table_eit *eit,
 		if (e == eit->event)
 			return;
 
+		/* The table owns the list, so free the one being replaced */
+		vidtv_psi_eit_event_destroy(eit->event);
+
 		eit->event = e;
 		vidtv_psi_eit_table_update_sec_len(eit);
 
-- 
2.53.0