linux-kernel - [PATCH] media: chips-media: wave5: Fix Potential Probe Resource Leak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20251119213152.1442329-1-b-brnich@ti.com>
Date: Wed, 19 Nov 2025 15:31:52 -0600
From: Brandon Brnich <b-brnich@...com>
To: Nas Chung <nas.chung@...psnmedia.com>, Jackson Lee
	<jackson.lee@...psnmedia.com>, Mauro Carvalho Chehab <mchehab@...nel.org>,
	<linux-media@...r.kernel.org>, <linux-kernel@...r.kernel.org>, "Nicolas
 Dufresne" <nicolas.dufresne@...labora.com>
CC: Darren Etheridge <detheridge@...com>, Brandon Brnich <b-brnich@...com>
Subject: [PATCH] media: chips-media: wave5: Fix Potential Probe Resource Leak

After kthread creation during probe sequence, a handful of other
failures could occur. If this were to happen, the kthread is never
explicitly deleted which results in a resource leak. Add explicit cleanup
of this resource.

Signed-off-by: Brandon Brnich <b-brnich@...com>
---

I am aware that all the dev attributes would be freed since it is
allocated using the devm_* framework. But I did not believe that this
framework would recursively free the thread and stop the timer. These
would just be dangling resources unable to get killed unless
deliberately removed in the probe function. 

 drivers/media/platform/chips-media/wave5/wave5-vpu.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu.c b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
index e1715d3f43b0..f027b4ac775a 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
@@ -339,6 +339,11 @@ static int wave5_vpu_probe(struct platform_device *pdev)
 	v4l2_device_unregister(&dev->v4l2_dev);
 err_vdi_release:
 	wave5_vdi_release(&pdev->dev);
+
+	if (dev->irq < 0) {
+		kthread_destroy_worker(dev->worker);
+		hrtimer_cancel(&dev->hrtimer);
+	}
 err_clk_dis:
 	clk_bulk_disable_unprepare(dev->num_clks, dev->clks);
 err_reset_assert:
-- 
2.34.1