comedi: runflags cannot determine whether to reclaim chanlist

syzbot reported a memory leak [1], because commit 4e1da516debb ("comedi:
Add reference counting for Comedi command handling") did not consider
the exceptional exit case in do_cmd_ioctl() where runflags is not set.
This caused chanlist not to be properly freed by do_become_nonbusy(),
as it only frees chanlist when runflags is correctly set.

Added a check in do_become_nonbusy() for the case where runflags is not
set, to properly free the chanlist memory.

[1]
BUG: memory leak
  backtrace (crc 844a0efa):
    __comedi_get_user_chanlist drivers/comedi/comedi_fops.c:1815 [inline]
    do_cmd_ioctl.part.0+0x112/0x350 drivers/comedi/comedi_fops.c:1890
    do_cmd_ioctl drivers/comedi/comedi_fops.c:1858 [inline]

Fixes: 4e1da516debb ("comedi: Add reference counting for Comedi command handling")
Reported-by: syzbot+f238baf6ded841b5a82e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f238baf6ded841b5a82e
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Cc: stable <stable@kernel.org> # 6.19
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20260310111104.70959-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/comedi/comedi_fops.c b/drivers/comedi/comedi_fops.c
index 48a8a607a84c266fbb173a1eddedb30efb787296..0df9f4636fb6bc0defffb974ca976f4d93277078 100644 (file)
--- a/drivers/comedi/comedi_fops.c
+++ b/drivers/comedi/comedi_fops.c
@@ -793,13 +793,15 @@ static void do_become_nonbusy(struct comedi_device *dev,
        __comedi_clear_subdevice_runflags(s, COMEDI_SRF_RUNNING |
                                             COMEDI_SRF_BUSY);
        spin_unlock_irqrestore(&s->spin_lock, flags);
-       if (comedi_is_runflags_busy(runflags)) {
+       if (async) {
                /*
                 * "Run active" counter was set to 1 when setting up the
                 * command.  Decrement it and wait for it to become 0.
                 */
-               comedi_put_is_subdevice_running(s);
-               wait_for_completion(&async->run_complete);
+               if (comedi_is_runflags_busy(runflags)) {
+                       comedi_put_is_subdevice_running(s);
+                       wait_for_completion(&async->run_complete);
+               }
                comedi_buf_reset(s);
                async->inttrig = NULL;
                kfree(async->cmd.chanlist);