From: Dan Carpenter <error27@gmail.com>
To: Dawei Feng <dawei.feng@seu.edu.cn>
Cc: andy@kernel.org, hansg@kernel.org, mchehab@kernel.org,
sakari.ailus@linux.intel.com, gregkh@linuxfoundation.org,
abdelrahmanfekry375@gmail.com, linux-kernel@vger.kernel.org,
linux-media@vger.kernel.org, linux-staging@lists.linux.dev,
jianhao.xu@seu.edu.cn, Zilin Guan <zilin@seu.edu.cn>
Subject: Re: [PATCH] media: atomisp: Fix resource leak in atomisp_pci_probe()
Date: Mon, 8 Jun 2026 11:51:45 +0300 [thread overview]
Message-ID: <aiaCoV1DQKBx4ph6@stanley.mountain> (raw)
In-Reply-To: <20260608082706.3287831-1-dawei.feng@seu.edu.cn>
On Mon, Jun 08, 2026 at 04:27:06PM +0800, Dawei Feng wrote:
> During atomisp_pci_probe(), the ISP subdev is initialized via
> atomisp_initialize_modules() prior to entity registration. If
> atomisp_register_entities() fails, the current error path only
> uninitializes the CSI2 modules. This leaks the subdev entity and control
> handler that were previously set up by atomisp_subdev_init().
>
> Fix this by calling atomisp_subdev_unregister_entities() to properly
> release the subdev state on this specific error path. Later error paths
> remain unchanged, as they correctly use atomisp_unregister_entities() to
> handle broader cleanup after successful registration.
>
> The bug was first flagged by an experimental analysis tool we are
> developing for kernel memory-management bugs while analyzing v6.13-rc1.
> The tool is still under development and is not yet publicly available.
> Manual inspection confirms that the bug is still present in v7.1-rc5.
>
> An x86_64 allyesconfig build showed no new warnings. As we do not have an
> Intel Atom ISP platform to test with, no runtime testing was able to be
> performed.
>
> Fixes: 9d4fa1a16b28 ("media: atomisp: cleanup directory hierarchy")
> Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
> Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
> ---
The code is buggy, but this isn't the right fix.
Here is generally the standard way to do error handling.
https://staticthinking.wordpress.com/2022/04/28/free-the-last-thing-style/
1. An allocation should clean up it's own partial allocations. That
should not be handled in the caller. 2. Every allocation function should
have a mirror cleanup function.
The atomisp_uninitialize_modules() function is just a dummy and was never
actually implemented. The correct thing is to implement it.
regards,
dan carpenter
next prev parent reply other threads:[~2026-06-08 8:51 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-08 8:27 [PATCH] media: atomisp: Fix resource leak in atomisp_pci_probe() Dawei Feng
2026-06-08 8:51 ` Dan Carpenter [this message]
2026-06-08 14:05 ` Dawei Feng
2026-06-08 8:57 ` sashiko-bot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aiaCoV1DQKBx4ph6@stanley.mountain \
--to=error27@gmail.com \
--cc=abdelrahmanfekry375@gmail.com \
--cc=andy@kernel.org \
--cc=dawei.feng@seu.edu.cn \
--cc=gregkh@linuxfoundation.org \
--cc=hansg@kernel.org \
--cc=jianhao.xu@seu.edu.cn \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=linux-staging@lists.linux.dev \
--cc=mchehab@kernel.org \
--cc=sakari.ailus@linux.intel.com \
--cc=zilin@seu.edu.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.