From: Huihui Huang Date: Thu, 16 Apr 2026 13:24:50 +0000 (+0800) Subject: staging: media: atomisp: fix map and vmap leaks in stat buffer allocation X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=12ea58282087b9df896fd0a43a92fa83e56b33c9;p=thirdparty%2Fkernel%2Flinux.git staging: media: atomisp: fix map and vmap leaks in stat buffer allocation There are memory leaks in drivers/staging/media/atomisp/pci/atomisp_compat_css20.c. In atomisp_css_allocate_stat_buffers(), s3a_map is allocated by ia_css_isp_3a_statistics_map_allocate() and its backing memory is mapped via hmm_vmap(). When dis_buf allocation fails, the error path frees s3a_data but does not unmap or free s3a_map. Similarly, when md_buf allocation fails, neither s3a_map nor dvs_map (and their hmm vmaps) are freed. Add the missing hmm_vunmap() and map free calls on both error paths, matching the cleanup order used in atomisp_css_free_3a_buffer() and atomisp_css_free_dis_buffer(). Signed-off-by: Huihui Huang Signed-off-by: Sakari Ailus --- diff --git a/drivers/staging/media/atomisp/pci/atomisp_compat_css20.c b/drivers/staging/media/atomisp/pci/atomisp_compat_css20.c index d2bacd1ffe7b..0ee52637ea30 100644 --- a/drivers/staging/media/atomisp/pci/atomisp_compat_css20.c +++ b/drivers/staging/media/atomisp/pci/atomisp_compat_css20.c @@ -1117,8 +1117,11 @@ int atomisp_css_allocate_stat_buffers(struct atomisp_sub_device *asd, dvs_grid_info); if (!dis_buf->dis_data) { dev_err(isp->dev, "dvs buf allocation failed.\n"); - if (s3a_buf) + if (s3a_buf) { + hmm_vunmap(s3a_buf->s3a_data->data_ptr); + ia_css_isp_3a_statistics_map_free(s3a_buf->s3a_map); ia_css_isp_3a_statistics_free(s3a_buf->s3a_data); + } return -EINVAL; } @@ -1132,10 +1135,16 @@ int atomisp_css_allocate_stat_buffers(struct atomisp_sub_device *asd, md_buf->metadata = ia_css_metadata_allocate( &asd->stream_env[stream_id].stream_info.metadata_info); if (!md_buf->metadata) { - if (s3a_buf) + if (s3a_buf) { + hmm_vunmap(s3a_buf->s3a_data->data_ptr); + ia_css_isp_3a_statistics_map_free(s3a_buf->s3a_map); ia_css_isp_3a_statistics_free(s3a_buf->s3a_data); - if (dis_buf) + } + if (dis_buf) { + hmm_vunmap(dis_buf->dis_data->data_ptr); + ia_css_isp_dvs_statistics_map_free(dis_buf->dvs_map); ia_css_isp_dvs2_statistics_free(dis_buf->dis_data); + } dev_err(isp->dev, "metadata buf allocation failed.\n"); return -EINVAL; }