Commit 29f644f1 authored by Edward Adam Davis's avatar Edward Adam Davis Committed by Greg Kroah-Hartman
Browse files

comedi: runflags cannot determine whether to reclaim chanlist 



syzbot reported a memory leak [1], because commit 4e1da516 ("comedi:
Add reference counting for Comedi command handling") did not consider
the exceptional exit case in do_cmd_ioctl() where runflags is not set.
This caused chanlist not to be properly freed by do_become_nonbusy(),
as it only frees chanlist when runflags is correctly set.

Added a check in do_become_nonbusy() for the case where runflags is not
set, to properly free the chanlist memory.

[1]
BUG: memory leak
  backtrace (crc 844a0efa):
    __comedi_get_user_chanlist drivers/comedi/comedi_fops.c:1815 [inline]
    do_cmd_ioctl.part.0+0x112/0x350 drivers/comedi/comedi_fops.c:1890
    do_cmd_ioctl drivers/comedi/comedi_fops.c:1858 [inline]

Fixes: 4e1da516 ("comedi: Add reference counting for Comedi command handling")
Reported-by: default avatar <syzbot+f238baf6ded841b5a82e@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=f238baf6ded841b5a82e


Signed-off-by: default avatarEdward Adam Davis <eadavis@qq.com>
Reviewed-by: default avatarIan Abbott <abbotti@mev.co.uk>
Cc: stable <stable@kernel.org> # 6.19
Signed-off-by: default avatarIan Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20260310111104.70959-1-abbotti@mev.co.uk


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 4b9a9a6d

drivers/comedi/comedi_fops.c

+5 −3
Original line number Diff line number Diff line
@@ -793,13 +793,15 @@ static void do_become_nonbusy(struct comedi_device *dev, 
	__comedi_clear_subdevice_runflags(s, COMEDI_SRF_RUNNING |

					     COMEDI_SRF_BUSY);

	spin_unlock_irqrestore(&s->spin_lock, flags);

	if (comedi_is_runflags_busy(runflags)) {

	if (async) {

		/*

		 * "Run active" counter was set to 1 when setting up the

		 * command.  Decrement it and wait for it to become 0.

		 */

		if (comedi_is_runflags_busy(runflags)) {

			comedi_put_is_subdevice_running(s);

			wait_for_completion(&async->run_complete);

		}

		comedi_buf_reset(s);

		async->inttrig = NULL;

		kfree(async->cmd.chanlist);