linux-kernel - Re: [PATCH v3] media: atomisp: Fix memory leak in atomisp_fixed_pattern

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aYIPg22Z-GDOy1fG@smile.fi.intel.com>
Date: Tue, 3 Feb 2026 17:08:51 +0200
From: Andy Shevchenko <andriy.shevchenko@...el.com>
To: Zilin Guan <zilin@....edu.cn>
Cc: andy.shevchenko@...il.com, andy@...nel.org, gregkh@...uxfoundation.org,
	hansg@...nel.org, hverkuil@...nel.org, jianhao.xu@....edu.cn,
	linux-kernel@...r.kernel.org, linux-media@...r.kernel.org,
	linux-staging@...ts.linux.dev, mchehab@...nel.org,
	sakari.ailus@...ux.intel.com
Subject: Re: [PATCH v3] media: atomisp: Fix memory leak in
 atomisp_fixed_pattern_table()

On Tue, Feb 03, 2026 at 01:56:59PM +0000, Zilin Guan wrote:
> atomisp_v4l2_framebuffer_to_css_frame() allocates memory for
> temporary variable raw_black_frame, which must be released via
> ia_css_frame_free() before the function returns. However, if
> sh_css_set_black_frame() fails, the function returns immediately without
> performing this cleanup, leading to a memory leak.
> 
> Fix this by assigning the return value of sh_css_set_black_frame() to
> ret. This ensures that the error code is propagated while allowing the
> execution to fall through to the ia_css_frame_free() cleanup call.
> 
> The bug was originally detected on v6.13-rc1 using an experimental
> static analysis tool we are developing, and we have verified that the
> issue persists in the latest mainline kernel. The tool is based on the
> LLVM framework and is specifically designed to detect memory management
> issues. It is currently under active development and not yet publicly
> available.
> 
> We performed build testing on x86_64 with allyesconfig. Since triggering
> this error path in atomisp requires specific Intel Atom ISP hardware and
> firmware, we were unable to perform runtime testing and instead verified
> the fix according to the code logic.

> Fixes: 85b606e02ad7 ("media: atomisp: get rid of a bunch of other wrappers")
> Suggested-by: Andy Shevchenko <andy.shevchenko@...il.com>

I haven't suggested this patch. I only provided a hint on a better
implementation, so there are no grounds to have this tag to be here.

Replace that with

Reviewed-by: Andy Shevchenko <andriy.shevchenko@...el.com>
as current version LGTM.

-- 
With Best Regards,
Andy Shevchenko