]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
media: atomisp: Fix memory leak in atomisp_fixed_pattern_table()
authorZilin Guan <zilin@seu.edu.cn>
Tue, 3 Feb 2026 16:31:34 +0000 (16:31 +0000)
committerSakari Ailus <sakari.ailus@linux.intel.com>
Wed, 20 May 2026 08:29:29 +0000 (11:29 +0300)
commit4e8156bd9517fa18c3613ea39c222c7035f0221e
tree5dff4c6c81353550f9bac1c016644dcf88b47022
parentf69992d08a06e9f105716a141731507f280f8b13
media: atomisp: Fix memory leak in atomisp_fixed_pattern_table()

atomisp_v4l2_framebuffer_to_css_frame() allocates memory for
temporary variable raw_black_frame, which must be released via
ia_css_frame_free() before the function returns. However, if
sh_css_set_black_frame() fails, the function returns immediately without
performing this cleanup, leading to a memory leak.

Fix this by assigning the return value of sh_css_set_black_frame() to
ret. This ensures that the error code is propagated while allowing the
execution to fall through to the ia_css_frame_free() cleanup call.

The bug was originally detected on v6.13-rc1 using an experimental
static analysis tool we are developing, and we have verified that the
issue persists in the latest mainline kernel. The tool is based on the
LLVM framework and is specifically designed to detect memory management
issues. It is currently under active development and not yet publicly
available.

We performed build testing on x86_64 with allyesconfig. Since triggering
this error path in atomisp requires specific Intel Atom ISP hardware and
firmware, we were unable to perform runtime testing and instead verified
the fix according to the code logic.

Fixes: 85b606e02ad7 ("media: atomisp: get rid of a bunch of other wrappers")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
drivers/staging/media/atomisp/pci/atomisp_cmd.c