[PATCH] media: dvb-core: fix memory leak in dvb_dmxdev_add_pid() on start failure

[Jose A. Perez de Azpillaga]

When dvb_dmxdev_add_pid() adds a new dmxdev_feed to the filter's ts list
and then dvb_dmxdev_start_feed() fails, the function returns the error
code but leaves the orphaned feed entry in the list without cleaning up.

Fix this by removing the orphaned feed from the list and freeing it when
dvb_dmxdev_start_feed() fails in dvb_dmxdev_add_pid().

Fixes: 1cb662a31449 ("V4L/DVB (12275): Add two new ioctls: DMX_ADD_PID and DMX_REMOVE_PID")
Reported-by: syzbot+afc686a471d70896c5d9@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=afc686a471d70896c5d9
Tested-by: syzbot+afc686a471d70896c5d9@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Jose A. Perez de Azpillaga <azpijr@xxxxxxxxx>
---
 drivers/media/dvb-core/dmxdev.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
index 3c8bc75e4d6c..401a0cbb4138 100644
--- a/drivers/media/dvb-core/dmxdev.c
+++ b/drivers/media/dvb-core/dmxdev.c
@@ -901,8 +901,15 @@ static int dvb_dmxdev_add_pid(struct dmxdev *dmxdev,
 	feed->pid = pid;
 	list_add(&feed->next, &filter->feed.ts);

-	if (filter->state >= DMXDEV_STATE_GO)
-		return dvb_dmxdev_start_feed(dmxdev, filter, feed);
+	if (filter->state >= DMXDEV_STATE_GO) {
+		int ret = dvb_dmxdev_start_feed(dmxdev, filter, feed);
+
+		if (ret < 0) {
+			list_del(&feed->next);
+			kfree(feed);
+		}
+		return ret;
+	}

 	return 0;
 }
--
2.53.0