From nobody Mon Feb 9 08:30:43 2026 Received: from mail-m49198.qiye.163.com (mail-m49198.qiye.163.com [45.254.49.198]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 55E4930DEB2; Tue, 3 Feb 2026 17:07:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.254.49.198 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770138431; cv=none; b=akcO862vt4PTeN/IAq5DnzFsdbRWt9Yh8SngAo3wJzmZOsp/cKFDMPDOqW0B0a9E1ZcmuAZR8ofOAtIe0bbmpC2bwRdCdLWzYkjyMOZXWUm5qH2yYwgRErOdycakTxcjRWEBRsm4ceU9rR4U/2nzdy3UOK0kaZH2t29KbazwAJI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770138431; c=relaxed/simple; bh=zBRGRrO3T2I/F2KJX0Sqq8SEcA9okuQA8wWpaaR4kAI=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=ex2pRdNxAFJb4uL+0hZ04r9w6M8muJKa6wm0MDyiojbLeMg9MrhZPWjUC9puIJkI4kD5xQadqLqfclt/1d9iUMMmHWNjxPj2dnl3othMmRoCHJ8P5NHnQX2ir9ZvaGKlT50dnFZ1huLmTepdM4a6WFkmPFH3RqwnVovbjABmFHc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn; spf=pass smtp.mailfrom=seu.edu.cn; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b=ByxnLfvN; arc=none smtp.client-ip=45.254.49.198 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b="ByxnLfvN" Received: from LAPTOP-N070L597.localdomain (unknown [58.241.16.34]) by smtp.qiye.163.com (Hmail) with ESMTP id 32fb5e820; Wed, 4 Feb 2026 00:31:40 +0800 (GMT+08:00) From: Zilin Guan To: andriy.shevchenko@intel.com Cc: andy@kernel.org, gregkh@linuxfoundation.org, hansg@kernel.org, hverkuil@kernel.org, jianhao.xu@seu.edu.cn, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, linux-staging@lists.linux.dev, mchehab@kernel.org, sakari.ailus@linux.intel.com, zilin@seu.edu.cn Subject: [PATCH v4] media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() Date: Tue, 3 Feb 2026 16:31:34 +0000 Message-Id: <20260203163134.3901110-1-zilin@seu.edu.cn> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-HM-Tid: 0a9c24586ce103a1kunmb7f083c22c5556 X-HM-MType: 10 X-HM-Spam-Status: e1kfGhgUHx5ZQUpXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFITzdXWS1ZQUlXWQ8JGhUIEh9ZQVlDQkJJVh9NS0weTh1DSB1LHlYeHw5VEwETFhoSFy QUDg9ZV1kYEgtZQVlOQ1VJT0pVSk1VSE9ZV1kWGg8SFR0UWUFZT0tIVUpLSUhOQ0NVSktLVUtZBg ++ DKIM-Signature: a=rsa-sha256; b=ByxnLfvNI3NbKZmfIhiIj6P195a2XrWov38b4OlFTNoqZCTvM1PMowaXjXK/05EV383gT1tgH6TR5wFKcLgm7nOZbEMKdru8iplU3t6Q38xTE5qMVS4pxL9heVDhtI+/qxAUKcNtID/kFEwhVIzYvSXmyWAoq3buI1PMhor7GiA=; s=default; c=relaxed/relaxed; d=seu.edu.cn; v=1; bh=fPzX7PAfqJp1evvjuzQQrpv7z6dB4W4LXypQWW8ZW9k=; h=date:mime-version:subject:message-id:from; Content-Type: text/plain; charset="utf-8" atomisp_v4l2_framebuffer_to_css_frame() allocates memory for temporary variable raw_black_frame, which must be released via ia_css_frame_free() before the function returns. However, if sh_css_set_black_frame() fails, the function returns immediately without performing this cleanup, leading to a memory leak. Fix this by assigning the return value of sh_css_set_black_frame() to ret. This ensures that the error code is propagated while allowing the execution to fall through to the ia_css_frame_free() cleanup call. The bug was originally detected on v6.13-rc1 using an experimental static analysis tool we are developing, and we have verified that the issue persists in the latest mainline kernel. The tool is based on the LLVM framework and is specifically designed to detect memory management issues. It is currently under active development and not yet publicly available. We performed build testing on x86_64 with allyesconfig. Since triggering this error path in atomisp requires specific Intel Atom ISP hardware and firmware, we were unable to perform runtime testing and instead verified the fix according to the code logic. Fixes: 85b606e02ad7 ("media: atomisp: get rid of a bunch of other wrappers") Signed-off-by: Zilin Guan Reviewed-by: Andy Shevchenko --- Changes in v4: - Replace Suggested-by with Reviewed-by. Changes in v3: - Assign the result of sh_css_set_black_frame() to ret instead of hardcoding -ENOMEM. Changes in v2: - Add detailed explanation about the tool and verification method. drivers/staging/media/atomisp/pci/atomisp_cmd.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/staging/media/atomisp/pci/atomisp_cmd.c b/drivers/stag= ing/media/atomisp/pci/atomisp_cmd.c index 3a4eb4f6d3be..ae9c4dc8a44b 100644 --- a/drivers/staging/media/atomisp/pci/atomisp_cmd.c +++ b/drivers/staging/media/atomisp/pci/atomisp_cmd.c @@ -3367,10 +3367,8 @@ int atomisp_fixed_pattern_table(struct atomisp_sub_d= evice *asd, if (ret) return ret; =20 - if (sh_css_set_black_frame(asd->stream_env[ATOMISP_INPUT_STREAM_GENERAL].= stream, - raw_black_frame) !=3D 0) - return -ENOMEM; - + ret =3D sh_css_set_black_frame(asd->stream_env[ATOMISP_INPUT_STREAM_GENER= AL].stream, + raw_black_frame); ia_css_frame_free(raw_black_frame); return ret; } --=20 2.34.1