Our code analyzer reported a memory leak in
drivers/staging/media/atomisp/pci/atomisp_cmd.c.

In atomisp_fixed_pattern_table(), raw_black_frame is allocated by
atomisp_v4l2_framebuffer_to_css_frame(). If sh_css_set_black_frame()
fails, the function returns -ENOMEM directly without freeing
raw_black_frame. The allocated memory is only freed on the success
path.

My patch adds the missing ia_css_frame_free() call before the error
return, to free raw_black_frame when sh_css_set_black_frame() fails.

Signed-off-by: Huihui Huang <hhhuang@smu.edu.sg>
---
 drivers/staging/media/atomisp/pci/atomisp_cmd.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/media/atomisp/pci/atomisp_cmd.c b/drivers/staging/media/atomisp/pci/atomisp_cmd.c
index fec369575..3cacf16cb 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_cmd.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_cmd.c
@@ -3365,8 +3365,10 @@ int atomisp_fixed_pattern_table(struct atomisp_sub_device *asd,
 		return ret;
 
 	if (sh_css_set_black_frame(asd->stream_env[ATOMISP_INPUT_STREAM_GENERAL].stream,
-				   raw_black_frame) != 0)
+				   raw_black_frame) != 0) {
+		ia_css_frame_free(raw_black_frame);
 		return -ENOMEM;
+	}
 
 	ia_css_frame_free(raw_black_frame);
 	return ret;
-- 
2.50.1

Hi Huihui,

On Thu, Apr 16, 2026 at 02:30:58PM +0800, Huihui Huang wrote:
> Our code analyzer reported a memory leak in
> drivers/staging/media/atomisp/pci/atomisp_cmd.c.
> 
> In atomisp_fixed_pattern_table(), raw_black_frame is allocated by
> atomisp_v4l2_framebuffer_to_css_frame(). If sh_css_set_black_frame()
> fails, the function returns -ENOMEM directly without freeing
> raw_black_frame. The allocated memory is only freed on the success
> path.
> 
> My patch adds the missing ia_css_frame_free() call before the error
> return, to free raw_black_frame when sh_css_set_black_frame() fails.
> 
> Signed-off-by: Huihui Huang <hhhuang@smu.edu.sg>

Thanks for the patch.

I believe the problem has been already addressed by
<20260203163134.3901110-1-zilin@seu.edu.cn>. It's in my atomisp branch.

-- 
Kind regards,

Sakari Ailus

On Thu, Apr 16, 2026 at 11:13:48AM +0300, Sakari Ailus wrote:
> On Thu, Apr 16, 2026 at 02:30:58PM +0800, Huihui Huang wrote:
> > Our code analyzer reported a memory leak in
> > drivers/staging/media/atomisp/pci/atomisp_cmd.c.
> > 
> > In atomisp_fixed_pattern_table(), raw_black_frame is allocated by
> > atomisp_v4l2_framebuffer_to_css_frame(). If sh_css_set_black_frame()
> > fails, the function returns -ENOMEM directly without freeing
> > raw_black_frame. The allocated memory is only freed on the success
> > path.
> > 
> > My patch adds the missing ia_css_frame_free() call before the error
> > return, to free raw_black_frame when sh_css_set_black_frame() fails.
> > 
> > Signed-off-by: Huihui Huang <hhhuang@smu.edu.sg>
> 
> Thanks for the patch.
> 
> I believe the problem has been already addressed by
> <20260203163134.3901110-1-zilin@seu.edu.cn>. It's in my atomisp branch.

And exactly the way I suggested here, thanks, Sakari!

P.S.
It would be nice to see rather links to the Git commits in question, because
patch in the mailing list is just patch in the mailing list :-)

-- 
With Best Regards,
Andy Shevchenko

On Thu, Apr 16, 2026 at 02:30:58PM +0800, Huihui Huang wrote:
> Our code analyzer reported a memory leak in
> drivers/staging/media/atomisp/pci/atomisp_cmd.c.
> 
> In atomisp_fixed_pattern_table(), raw_black_frame is allocated by
> atomisp_v4l2_framebuffer_to_css_frame(). If sh_css_set_black_frame()
> fails, the function returns -ENOMEM directly without freeing
> raw_black_frame. The allocated memory is only freed on the success
> path.
> 
> My patch adds the missing ia_css_frame_free() call before the error

s/My patch adds/Add/

> return, to free raw_black_frame when sh_css_set_black_frame() fails.

...

>  	if (sh_css_set_black_frame(asd->stream_env[ATOMISP_INPUT_STREAM_GENERAL].stream,
> -				   raw_black_frame) != 0)
> +				   raw_black_frame) != 0) {
> +		ia_css_frame_free(raw_black_frame);
>  		return -ENOMEM;
> +	}
>  
>  	ia_css_frame_free(raw_black_frame);
>  	return ret;

This is unneeded complication. What you need to do is just replacing if
conditional completely.

	ret = sh_css_set_black_frame(asd->stream_env[ATOMISP_INPUT_STREAM_GENERAL].stream,
				     raw_black_frame);

-- 
With Best Regards,
Andy Shevchenko