tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

comedi: runflags cannot determine whether to reclaim chanlist

syzbot reported a memory leak [1], because commit 4e1da516debb ("comedi:
Add reference counting for Comedi command handling") did not consider
the exceptional exit case in do_cmd_ioctl() where runflags is not set.
This caused chanlist not to be properly freed by do_become_nonbusy(),
as it only frees chanlist when runflags is correctly set.

Added a check in do_become_nonbusy() for the case where runflags is not
set, to properly free the chanlist memory.

[1]
BUG: memory leak
backtrace (crc 844a0efa):
__comedi_get_user_chanlist drivers/comedi/comedi_fops.c:1815 [inline]
do_cmd_ioctl.part.0+0x112/0x350 drivers/comedi/comedi_fops.c:1890
do_cmd_ioctl drivers/comedi/comedi_fops.c:1858 [inline]

Fixes: 4e1da516debb ("comedi: Add reference counting for Comedi command handling")
Reported-by: syzbot+f238baf6ded841b5a82e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f238baf6ded841b5a82e
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Cc: stable <stable@kernel.org> # 6.19
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20260310111104.70959-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Edward Adam Davis and committed by
Greg Kroah-Hartman 29f644f1 4b9a9a6d

+5 -3
+5 -3
drivers/comedi/comedi_fops.c
··· 793 793 __comedi_clear_subdevice_runflags(s, COMEDI_SRF_RUNNING | 794 794 COMEDI_SRF_BUSY); 795 795 spin_unlock_irqrestore(&s->spin_lock, flags); 796 - if (comedi_is_runflags_busy(runflags)) { 796 + if (async) { 797 797 /* 798 798 * "Run active" counter was set to 1 when setting up the 799 799 * command. Decrement it and wait for it to become 0. 800 800 */ 801 - comedi_put_is_subdevice_running(s); 802 - wait_for_completion(&async->run_complete); 801 + if (comedi_is_runflags_busy(runflags)) { 802 + comedi_put_is_subdevice_running(s); 803 + wait_for_completion(&async->run_complete); 804 + } 803 805 comedi_buf_reset(s); 804 806 async->inttrig = NULL; 805 807 kfree(async->cmd.chanlist);