linux-kernel - Re: [PATCH v2] media: atomisp: Fix memory leak in atomisp_fixed_pattern

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAHp75Vd1jd9o3NuFOEBH9DHhX7VZcqYfkaZ6N4AvKJz0=7Wg1g@mail.gmail.com>
Date: Tue, 3 Feb 2026 10:12:34 +0200
From: Andy Shevchenko <andy.shevchenko@...il.com>
To: Zilin Guan <zilin@....edu.cn>
Cc: andy@...nel.org, hansg@...nel.org, mchehab@...nel.org, 
	sakari.ailus@...ux.intel.com, gregkh@...uxfoundation.org, hverkuil@...nel.org, 
	linux-kernel@...r.kernel.org, linux-media@...r.kernel.org, 
	linux-staging@...ts.linux.dev, jianhao.xu@....edu.cn
Subject: Re: [PATCH v2] media: atomisp: Fix memory leak in atomisp_fixed_pattern_table()

On Sun, Feb 1, 2026 at 3:59 PM Zilin Guan <zilin@....edu.cn> wrote:
>
> atomisp_v4l2_framebuffer_to_css_frame() allocates memory for
> temporary variable raw_black_frame, which must be released via
> ia_css_frame_free() before the function returns. However, if
> sh_css_set_black_frame() fails, the function returns immediately without
> performing this cleanup, leading to a memory leak.
>
> Fix this by assigning the error code to ret and allowing the code to
> fall through to the ia_css_frame_free() call.
>
> The bug was originally detected on v6.13-rc1 using an experimental
> static analysis tool we are developing, and we have verified that the
> issue persists in the latest mainline kernel. The tool is based on the
> LLVM framework and is specifically designed to detect memory management
> issues. It is currently under active development and not yet publicly
> available.
>
> We performed build testing on x86_64 with allyesconfig. Since triggering
> this error path in atomisp requires specific Intel Atom ISP hardware and
> firmware, we were unable to perform runtime testing and instead verified
> the fix according to the code logic.

...

> +++ b/drivers/staging/media/atomisp/pci/atomisp_cmd.c
> @@ -3369,7 +3369,7 @@ int atomisp_fixed_pattern_table(struct atomisp_sub_device *asd,
>
>         if (sh_css_set_black_frame(asd->stream_env[ATOMISP_INPUT_STREAM_GENERAL].stream,
>                                    raw_black_frame) != 0)
> -               return -ENOMEM;
> +               ret = -ENOMEM;
>
>         ia_css_frame_free(raw_black_frame);
>         return ret;


No, instead assign the returned code to ret to begin with

  ret = sh_css_set_black_frame(...);
  ia_css_frame_free(raw_black_frame);
  return ret;

-- 
With Best Regards,
Andy Shevchenko