From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
To: Eugen Hristev <ehristev@kernel.org>
Cc: Raspberry Pi Kernel Maintenance <kernel-list@raspberrypi.com>,
Mauro Carvalho Chehab <mchehab@kernel.org>,
Florian Fainelli <florian.fainelli@broadcom.com>,
Broadcom internal kernel review list
<bcm-kernel-feedback-list@broadcom.com>,
Ray Jui <rjui@broadcom.com>,
Scott Branden <sbranden@broadcom.com>,
Hans Verkuil <hverkuil@kernel.org>,
Naushir Patuck <naush@raspberrypi.com>,
Sakari Ailus <sakari.ailus@linux.intel.com>,
Dave Stevenson <dave.stevenson@raspberrypi.com>,
Jean-Michel Hautbois <jeanmichel.hautbois@yoseli.org>,
linux-media@vger.kernel.org,
linux-rpi-kernel@lists.infradead.org,
linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] media: bcm2835-unicam: Fix asc leaked in error/remove path
Date: Tue, 9 Jun 2026 22:39:29 +0300 [thread overview]
Message-ID: <20260609193929.GC1132670@killaraus.ideasonboard.com> (raw)
In-Reply-To: <20260609-bcmpiclean-v1-1-23bdeb19caf6@kernel.org>
On Tue, Jun 09, 2026 at 08:05:23PM +0300, Eugen Hristev wrote:
> v4l2_async_nf_add_fwnode_remote() allocates the asc, which is freed when
> v4l2_async_nf_cleanup() is called.
>
> Call v4l2_async_nf_cleanup() properly in the driver paths.
>
> Discovered with kmemleak after rmmod:
>
> unreferenced object 0xffff000084526b80 (size 64):
> comm "modprobe", pid 185, jiffies 4295013512
> hex dump (first 32 bytes):
> 01 00 00 00 00 00 00 00 e8 0d ff bf 00 00 ff ff ................
> 40 83 bc 84 00 00 ff ff 60 83 bc 84 00 00 ff ff @.......`.......
> backtrace (crc ac584083):
> [<00000000ffb081a7>] kmemleak_alloc+0x38/0x44
> [<00000000d2fd9301>] __kmalloc+0x1b0/0x250
> [<000000004dd5354d>] __v4l2_async_nf_add_fwnode+0x28/0x9c
> [<0000000067587657>] __v4l2_async_nf_add_fwnode_remote+0x3c/0x64
>
> Fixes: 392cd78d495f ("media: bcm2835-unicam: Add support for CCP2/CSI2 camera interface")
> Signed-off-by: Eugen Hristev <ehristev@kernel.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
> ---
> drivers/media/platform/broadcom/bcm2835-unicam.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/media/platform/broadcom/bcm2835-unicam.c b/drivers/media/platform/broadcom/bcm2835-unicam.c
> index 8d28ba0b59a3..1508843ae58c 100644
> --- a/drivers/media/platform/broadcom/bcm2835-unicam.c
> +++ b/drivers/media/platform/broadcom/bcm2835-unicam.c
> @@ -2613,6 +2613,7 @@ static int unicam_async_nf_init(struct unicam_device *unicam)
> return 0;
>
> error:
> + v4l2_async_nf_cleanup(&unicam->notifier);
> fwnode_handle_put(ep_handle);
> return ret;
> }
> @@ -2745,6 +2746,7 @@ static void unicam_remove(struct platform_device *pdev)
> v4l2_device_unregister(&unicam->v4l2_dev);
> media_device_unregister(&unicam->mdev);
> v4l2_async_nf_unregister(&unicam->notifier);
> + v4l2_async_nf_cleanup(&unicam->notifier);
>
> unicam_subdev_cleanup(unicam);
>
>
> ---
> base-commit: a87737435cfa134f9cdcc696ba3080759d04cf72
> change-id: 20260609-bcmpiclean-69a8ee3192b0
--
Regards,
Laurent Pinchart
prev parent reply other threads:[~2026-06-09 19:39 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-09 17:05 [PATCH] media: bcm2835-unicam: Fix asc leaked in error/remove path Eugen Hristev
2026-06-09 19:39 ` Laurent Pinchart [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260609193929.GC1132670@killaraus.ideasonboard.com \
--to=laurent.pinchart@ideasonboard.com \
--cc=bcm-kernel-feedback-list@broadcom.com \
--cc=dave.stevenson@raspberrypi.com \
--cc=ehristev@kernel.org \
--cc=florian.fainelli@broadcom.com \
--cc=hverkuil@kernel.org \
--cc=jeanmichel.hautbois@yoseli.org \
--cc=kernel-list@raspberrypi.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=linux-rpi-kernel@lists.infradead.org \
--cc=mchehab@kernel.org \
--cc=naush@raspberrypi.com \
--cc=rjui@broadcom.com \
--cc=sakari.ailus@linux.intel.com \
--cc=sbranden@broadcom.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox