[PATCH] usb: gadget: uvc: fix dwFrameInterval array leak on frame removal

[PATCH] usb: gadget: uvc: fix dwFrameInterval array leak on frame removal

[Priyanka Mani]

uvcg_frame_dw_frame_interval_store() allocates the frame interval array
and stores it in uvcg_frame::dw_frame_interval. The array is only freed
when it is replaced by a later write to the dwFrameInterval attribute.

Frame items use the generic uvcg_config_item_release(), which frees the
frame itself but not the interval array, so the array is leaked every
time a frame directory is removed after dwFrameInterval was written.
This happens on every normal teardown of a configfs UVC gadget, and
kmemleak reports it as:

  unreferenced object 0xffff8881027f5040 (size 8):
    comm "uvc-frame-inter", pid 281, jiffies 4294827366
    hex dump (first 8 bytes):
      15 16 05 00 00 00 00 00                          ........
    backtrace (crc 60980708):
      __kmalloc_noprof+0x4ca/0x7a0
      uvcg_frame_dw_frame_interval_store+0x299/0x440 [usb_f_uvc]
      configfs_write_iter+0x2ac/0x490
      vfs_write+0x60f/0x1100
      ksys_write+0xf9/0x1d0
      do_syscall_64+0xfa/0x5e0

Give frames their own release callback that frees the interval array
together with the frame.

The leak was found with kmemleak while exercising configfs gadget
functions in a VM.

Fixes: 46919a23ee87 ("usb: gadget: uvc: configfs support in uvc function")
Cc: stable@vger.kernel.org
Signed-off-by: Priyanka Mani <priyankamani2100@gmail.com>
---
 drivers/usb/gadget/function/uvc_configfs.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c
index 70a1415ea401..48105b36dbfa 100644
--- a/drivers/usb/gadget/function/uvc_configfs.c
+++ b/drivers/usb/gadget/function/uvc_configfs.c
@@ -2142,14 +2142,26 @@ static struct configfs_attribute *uvcg_frame_attrs2[] = {
 	NULL,
 };
 
+static void uvcg_frame_release(struct config_item *item)
+{
+	struct uvcg_frame *frm = to_uvcg_frame(item);
+
+	kfree(frm->dw_frame_interval);
+	kfree(frm);
+}
+
+static const struct configfs_item_operations uvcg_frame_item_ops = {
+	.release	= uvcg_frame_release,
+};
+
 static const struct config_item_type uvcg_frame_type1 = {
-	.ct_item_ops	= &uvcg_config_item_ops,
+	.ct_item_ops	= &uvcg_frame_item_ops,
 	.ct_attrs	= uvcg_frame_attrs1,
 	.ct_owner	= THIS_MODULE,
 };
 
 static const struct config_item_type uvcg_frame_type2 = {
-	.ct_item_ops    = &uvcg_config_item_ops,
+	.ct_item_ops    = &uvcg_frame_item_ops,
 	.ct_attrs       = uvcg_frame_attrs2,
 	.ct_owner       = THIS_MODULE,
 };
-- 
2.43.0