Linux-ARM-Kernel Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
To: Eugen Hristev <ehristev@kernel.org>
Cc: Raspberry Pi Kernel Maintenance <kernel-list@raspberrypi.com>,
	Mauro Carvalho Chehab <mchehab@kernel.org>,
	Florian Fainelli <florian.fainelli@broadcom.com>,
	Broadcom internal kernel review list
	<bcm-kernel-feedback-list@broadcom.com>,
	Ray Jui <rjui@broadcom.com>,
	Scott Branden <sbranden@broadcom.com>,
	Hans Verkuil <hverkuil@kernel.org>,
	Naushir Patuck <naush@raspberrypi.com>,
	Sakari Ailus <sakari.ailus@linux.intel.com>,
	Dave Stevenson <dave.stevenson@raspberrypi.com>,
	Jean-Michel Hautbois <jeanmichel.hautbois@yoseli.org>,
	linux-media@vger.kernel.org,
	linux-rpi-kernel@lists.infradead.org,
	linux-arm-kernel@lists.infradead.org,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH] media: bcm2835-unicam: Fix asc leaked in error/remove path
Date: Tue, 9 Jun 2026 22:39:29 +0300	[thread overview]
Message-ID: <20260609193929.GC1132670@killaraus.ideasonboard.com> (raw)
In-Reply-To: <20260609-bcmpiclean-v1-1-23bdeb19caf6@kernel.org>

On Tue, Jun 09, 2026 at 08:05:23PM +0300, Eugen Hristev wrote:
> v4l2_async_nf_add_fwnode_remote() allocates the asc, which is freed when
> v4l2_async_nf_cleanup() is called.
> 
> Call v4l2_async_nf_cleanup() properly in the driver paths.
> 
> Discovered with kmemleak after rmmod:
> 
> unreferenced object 0xffff000084526b80 (size 64):
>   comm "modprobe", pid 185, jiffies 4295013512
>   hex dump (first 32 bytes):
>     01 00 00 00 00 00 00 00 e8 0d ff bf 00 00 ff ff  ................
>     40 83 bc 84 00 00 ff ff 60 83 bc 84 00 00 ff ff  @.......`.......
>   backtrace (crc ac584083):
>     [<00000000ffb081a7>] kmemleak_alloc+0x38/0x44
>     [<00000000d2fd9301>] __kmalloc+0x1b0/0x250
>     [<000000004dd5354d>] __v4l2_async_nf_add_fwnode+0x28/0x9c
>     [<0000000067587657>] __v4l2_async_nf_add_fwnode_remote+0x3c/0x64
> 
> Fixes: 392cd78d495f ("media: bcm2835-unicam: Add support for CCP2/CSI2 camera interface")
> Signed-off-by: Eugen Hristev <ehristev@kernel.org>

Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>

> ---
>  drivers/media/platform/broadcom/bcm2835-unicam.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/media/platform/broadcom/bcm2835-unicam.c b/drivers/media/platform/broadcom/bcm2835-unicam.c
> index 8d28ba0b59a3..1508843ae58c 100644
> --- a/drivers/media/platform/broadcom/bcm2835-unicam.c
> +++ b/drivers/media/platform/broadcom/bcm2835-unicam.c
> @@ -2613,6 +2613,7 @@ static int unicam_async_nf_init(struct unicam_device *unicam)
>  	return 0;
>  
>  error:
> +	v4l2_async_nf_cleanup(&unicam->notifier);
>  	fwnode_handle_put(ep_handle);
>  	return ret;
>  }
> @@ -2745,6 +2746,7 @@ static void unicam_remove(struct platform_device *pdev)
>  	v4l2_device_unregister(&unicam->v4l2_dev);
>  	media_device_unregister(&unicam->mdev);
>  	v4l2_async_nf_unregister(&unicam->notifier);
> +	v4l2_async_nf_cleanup(&unicam->notifier);
>  
>  	unicam_subdev_cleanup(unicam);
>  
> 
> ---
> base-commit: a87737435cfa134f9cdcc696ba3080759d04cf72
> change-id: 20260609-bcmpiclean-69a8ee3192b0

-- 
Regards,

Laurent Pinchart


      reply	other threads:[~2026-06-09 19:39 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-06-09 17:05 [PATCH] media: bcm2835-unicam: Fix asc leaked in error/remove path Eugen Hristev
2026-06-09 19:39 ` Laurent Pinchart [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260609193929.GC1132670@killaraus.ideasonboard.com \
    --to=laurent.pinchart@ideasonboard.com \
    --cc=bcm-kernel-feedback-list@broadcom.com \
    --cc=dave.stevenson@raspberrypi.com \
    --cc=ehristev@kernel.org \
    --cc=florian.fainelli@broadcom.com \
    --cc=hverkuil@kernel.org \
    --cc=jeanmichel.hautbois@yoseli.org \
    --cc=kernel-list@raspberrypi.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-media@vger.kernel.org \
    --cc=linux-rpi-kernel@lists.infradead.org \
    --cc=mchehab@kernel.org \
    --cc=naush@raspberrypi.com \
    --cc=rjui@broadcom.com \
    --cc=sakari.ailus@linux.intel.com \
    --cc=sbranden@broadcom.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox