linux-kernel - [PATCH 08/13] platform/raspberrypi: vchiq-mmal: Fix memory leak in error path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20251031-b4-vc-sm-cma-v1-8-0dd5c0ec3f5c@ideasonboard.com>
Date: Fri, 31 Oct 2025 22:57:28 +0530
From: Jai Luthra <jai.luthra@...asonboard.com>
To: Florian Fainelli <florian.fainelli@...adcom.com>, 
 Raspberry Pi Kernel Maintenance <kernel-list@...pberrypi.com>, 
 bcm-kernel-feedback-list@...adcom.com
Cc: Dave Stevenson <dave.stevenson@...pberrypi.com>, 
 Phil Elwell <phil@...pberrypi.com>, Stefan Wahren <wahrenst@....net>, 
 Laurent Pinchart <laurent.pinchart@...asonboard.com>, 
 Kieran Bingham <kieran.bingham@...asonboard.com>, 
 Sumit Semwal <sumit.semwal@...aro.org>, 
 Christian König <christian.koenig@....com>, 
 linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org, 
 Jai Luthra <jai.luthra@...asonboard.com>, 
 Dave Stevenson <dave.stevenson@...pberrypi.org>
Subject: [PATCH 08/13] platform/raspberrypi: vchiq-mmal: Fix memory leak in
 error path

From: Dave Stevenson <dave.stevenson@...pberrypi.org>

On error, vchiq_mmal_component_init could leave the
event context allocated for ports.
Clean them up in the error path.

Signed-off-by: Dave Stevenson <dave.stevenson@...pberrypi.org>
Signed-off-by: Jai Luthra <jai.luthra@...asonboard.com>
---
 drivers/platform/raspberrypi/vchiq-mmal/mmal-vchiq.c | 29 ++++++++++++++++++++---------
 1 file changed, 20 insertions(+), 9 deletions(-)

diff --git a/drivers/platform/raspberrypi/vchiq-mmal/mmal-vchiq.c b/drivers/platform/raspberrypi/vchiq-mmal/mmal-vchiq.c
index 36f3b068c825e6a26508aefe544f7061c9559510..3c99d0f3e57178761ec57d97cd77e59aa26143fa 100644
--- a/drivers/platform/raspberrypi/vchiq-mmal/mmal-vchiq.c
+++ b/drivers/platform/raspberrypi/vchiq-mmal/mmal-vchiq.c
@@ -1768,9 +1768,26 @@ static void free_event_context(struct vchiq_mmal_port *port)
 {
 	struct mmal_msg_context *ctx = port->event_context;
 
+	if (!ctx)
+		return;
+
 	kfree(ctx->u.bulk.buffer->buffer);
 	kfree(ctx->u.bulk.buffer);
 	release_msg_context(ctx);
+	port->event_context = NULL;
+}
+
+static void release_all_event_contexts(struct vchiq_mmal_component *component)
+{
+	int idx;
+
+	for (idx = 0; idx < component->inputs; idx++)
+		free_event_context(&component->input[idx]);
+	for (idx = 0; idx < component->outputs; idx++)
+		free_event_context(&component->output[idx]);
+	for (idx = 0; idx < component->clocks; idx++)
+		free_event_context(&component->clock[idx]);
+	free_event_context(&component->control);
 }
 
 /* Initialise a mmal component and its ports
@@ -1868,6 +1885,7 @@ int vchiq_mmal_component_init(struct vchiq_mmal_instance *instance,
 
 release_component:
 	destroy_component(instance, component);
+	release_all_event_contexts(component);
 unlock:
 	if (component)
 		component->in_use = false;
@@ -1883,7 +1901,7 @@ EXPORT_SYMBOL_GPL(vchiq_mmal_component_init);
 int vchiq_mmal_component_finalise(struct vchiq_mmal_instance *instance,
 				  struct vchiq_mmal_component *component)
 {
-	int ret, idx;
+	int ret;
 
 	if (mutex_lock_interruptible(&instance->vchiq_mutex))
 		return -EINTR;
@@ -1895,14 +1913,7 @@ int vchiq_mmal_component_finalise(struct vchiq_mmal_instance *instance,
 
 	component->in_use = false;
 
-	for (idx = 0; idx < component->inputs; idx++)
-		free_event_context(&component->input[idx]);
-	for (idx = 0; idx < component->outputs; idx++)
-		free_event_context(&component->output[idx]);
-	for (idx = 0; idx < component->clocks; idx++)
-		free_event_context(&component->clock[idx]);
-
-	free_event_context(&component->control);
+	release_all_event_contexts(component);
 
 	mutex_unlock(&instance->vchiq_mutex);
 

-- 
2.51.0