[PATCH] media: bcm2835-unicam: Fix asc leaked in error/remove path

[PATCH] media: bcm2835-unicam: Fix asc leaked in error/remove path

[Eugen Hristev]

v4l2_async_nf_add_fwnode_remote() allocates the asc, which is freed when
v4l2_async_nf_cleanup() is called.

Call v4l2_async_nf_cleanup() properly in the driver paths.

Discovered with kmemleak after rmmod:

unreferenced object 0xffff000084526b80 (size 64):
  comm "modprobe", pid 185, jiffies 4295013512
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 e8 0d ff bf 00 00 ff ff  ................
    40 83 bc 84 00 00 ff ff 60 83 bc 84 00 00 ff ff  @.......`.......
  backtrace (crc ac584083):
    [<00000000ffb081a7>] kmemleak_alloc+0x38/0x44
    [<00000000d2fd9301>] __kmalloc+0x1b0/0x250
    [<000000004dd5354d>] __v4l2_async_nf_add_fwnode+0x28/0x9c
    [<0000000067587657>] __v4l2_async_nf_add_fwnode_remote+0x3c/0x64

Fixes: 392cd78d495f ("media: bcm2835-unicam: Add support for CCP2/CSI2 camera interface")
Signed-off-by: Eugen Hristev <ehristev@kernel.org>
---
 drivers/media/platform/broadcom/bcm2835-unicam.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/platform/broadcom/bcm2835-unicam.c b/drivers/media/platform/broadcom/bcm2835-unicam.c
index 8d28ba0b59a3..1508843ae58c 100644
--- a/drivers/media/platform/broadcom/bcm2835-unicam.c
+++ b/drivers/media/platform/broadcom/bcm2835-unicam.c
@@ -2613,6 +2613,7 @@ static int unicam_async_nf_init(struct unicam_device *unicam)
 	return 0;
 
 error:
+	v4l2_async_nf_cleanup(&unicam->notifier);
 	fwnode_handle_put(ep_handle);
 	return ret;
 }
@@ -2745,6 +2746,7 @@ static void unicam_remove(struct platform_device *pdev)
 	v4l2_device_unregister(&unicam->v4l2_dev);
 	media_device_unregister(&unicam->mdev);
 	v4l2_async_nf_unregister(&unicam->notifier);
+	v4l2_async_nf_cleanup(&unicam->notifier);
 
 	unicam_subdev_cleanup(unicam);
 

---
base-commit: a87737435cfa134f9cdcc696ba3080759d04cf72
change-id: 20260609-bcmpiclean-69a8ee3192b0

Best regards,
--  
Eugen Hristev <ehristev@kernel.org>

Re: [PATCH] media: bcm2835-unicam: Fix asc leaked in error/remove path

[Laurent Pinchart]

On Tue, Jun 09, 2026 at 08:05:23PM +0300, Eugen Hristev wrote:
> v4l2_async_nf_add_fwnode_remote() allocates the asc, which is freed when
> v4l2_async_nf_cleanup() is called.
> 
> Call v4l2_async_nf_cleanup() properly in the driver paths.
> 
> Discovered with kmemleak after rmmod:
> 
> unreferenced object 0xffff000084526b80 (size 64):
>   comm "modprobe", pid 185, jiffies 4295013512
>   hex dump (first 32 bytes):
>     01 00 00 00 00 00 00 00 e8 0d ff bf 00 00 ff ff  ................
>     40 83 bc 84 00 00 ff ff 60 83 bc 84 00 00 ff ff  @.......`.......
>   backtrace (crc ac584083):
>     [<00000000ffb081a7>] kmemleak_alloc+0x38/0x44
>     [<00000000d2fd9301>] __kmalloc+0x1b0/0x250
>     [<000000004dd5354d>] __v4l2_async_nf_add_fwnode+0x28/0x9c
>     [<0000000067587657>] __v4l2_async_nf_add_fwnode_remote+0x3c/0x64
> 
> Fixes: 392cd78d495f ("media: bcm2835-unicam: Add support for CCP2/CSI2 camera interface")
> Signed-off-by: Eugen Hristev <ehristev@kernel.org>

Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>

> ---
>  drivers/media/platform/broadcom/bcm2835-unicam.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/media/platform/broadcom/bcm2835-unicam.c b/drivers/media/platform/broadcom/bcm2835-unicam.c
> index 8d28ba0b59a3..1508843ae58c 100644
> --- a/drivers/media/platform/broadcom/bcm2835-unicam.c
> +++ b/drivers/media/platform/broadcom/bcm2835-unicam.c
> @@ -2613,6 +2613,7 @@ static int unicam_async_nf_init(struct unicam_device *unicam)
>  	return 0;
>  
>  error:
> +	v4l2_async_nf_cleanup(&unicam->notifier);
>  	fwnode_handle_put(ep_handle);
>  	return ret;
>  }
> @@ -2745,6 +2746,7 @@ static void unicam_remove(struct platform_device *pdev)
>  	v4l2_device_unregister(&unicam->v4l2_dev);
>  	media_device_unregister(&unicam->mdev);
>  	v4l2_async_nf_unregister(&unicam->notifier);
> +	v4l2_async_nf_cleanup(&unicam->notifier);
>  
>  	unicam_subdev_cleanup(unicam);
>  
> 
> ---
> base-commit: a87737435cfa134f9cdcc696ba3080759d04cf72
> change-id: 20260609-bcmpiclean-69a8ee3192b0

-- 
Regards,

Laurent Pinchart