linux-kernel - Re: [PATCH v2] media: atomisp: Fix memory leak in atomisp_fixed_pattern

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20260203123042.3745628-1-zilin@seu.edu.cn>
Date: Tue,  3 Feb 2026 12:30:42 +0000
From: Zilin Guan <zilin@....edu.cn>
To: andy.shevchenko@...il.com
Cc: andy@...nel.org,
	gregkh@...uxfoundation.org,
	hansg@...nel.org,
	hverkuil@...nel.org,
	jianhao.xu@....edu.cn,
	linux-kernel@...r.kernel.org,
	linux-media@...r.kernel.org,
	linux-staging@...ts.linux.dev,
	mchehab@...nel.org,
	sakari.ailus@...ux.intel.com,
	zilin@....edu.cn
Subject: Re: [PATCH v2] media: atomisp: Fix memory leak in atomisp_fixed_pattern_table()

On Tue, Feb 03, 2026 at 10:12:34AM +0200, Andy Shevchenko wrote:
> On Sun, Feb 1, 2026 at 3:59 PM Zilin Guan <zilin@....edu.cn> wrote:
> >
> > atomisp_v4l2_framebuffer_to_css_frame() allocates memory for
> > temporary variable raw_black_frame, which must be released via
> > ia_css_frame_free() before the function returns. However, if
> > sh_css_set_black_frame() fails, the function returns immediately without
> > performing this cleanup, leading to a memory leak.
> >
> > Fix this by assigning the error code to ret and allowing the code to
> > fall through to the ia_css_frame_free() call.
> >
> > The bug was originally detected on v6.13-rc1 using an experimental
> > static analysis tool we are developing, and we have verified that the
> > issue persists in the latest mainline kernel. The tool is based on the
> > LLVM framework and is specifically designed to detect memory management
> > issues. It is currently under active development and not yet publicly
> > available.
> >
> > We performed build testing on x86_64 with allyesconfig. Since triggering
> > this error path in atomisp requires specific Intel Atom ISP hardware and
> > firmware, we were unable to perform runtime testing and instead verified
> > the fix according to the code logic.
> 
> ...
> 
> > +++ b/drivers/staging/media/atomisp/pci/atomisp_cmd.c
> > @@ -3369,7 +3369,7 @@ int atomisp_fixed_pattern_table(struct atomisp_sub_device *asd,
> >
> >         if (sh_css_set_black_frame(asd->stream_env[ATOMISP_INPUT_STREAM_GENERAL].stream,
> >                                    raw_black_frame) != 0)
> > -               return -ENOMEM;
> > +               ret = -ENOMEM;
> >
> >         ia_css_frame_free(raw_black_frame);
> >         return ret;
> 
> 
> No, instead assign the returned code to ret to begin with
> 
>   ret = sh_css_set_black_frame(...);
>   ia_css_frame_free(raw_black_frame);
>   return ret;
> 
> -- 
> With Best Regards,
> Andy Shevchenko

Hi Andy,

Thanks for the suggestion. Assigning the return value directly to ret is 
indeed cleaner.

I will update the code as suggested and send v3.

Best regards,
Zilin Guan