* [PATCH] media: mali-c55: fix resource leaks in probe and remove
@ 2026-03-26 19:00 David Carlier
2026-03-26 20:33 ` David Carlier
` (2 more replies)
0 siblings, 3 replies; 7+ messages in thread
From: David Carlier @ 2026-03-26 19:00 UTC (permalink / raw)
To: Daniel Scally, Jacopo Mondi, Mauro Carvalho Chehab,
Nayden Kanchev, Hans Verkuil
Cc: linux-media, David Carlier
mali_c55_probe() calls of_reserved_mem_device_init() to associate
reserved memory regions with the device. This function allocates a
struct rmem_assigned_device and adds it to a global linked list, which
must be explicitly released via of_reserved_mem_device_release() — there
is no devm variant of this API.
However, neither the probe error paths nor mali_c55_remove() called
of_reserved_mem_device_release(). Any probe failure after the
of_reserved_mem_device_init() call, as well as every normal device
removal, leaked the reserved memory association on the global list.
Additionally, pm_runtime_enable() called during probe was never undone
in mali_c55_remove(), leaving the device's runtime PM state enabled
after the driver is unbound. The probe error path had a related issue:
when mali_c55_media_frameworks_init() failed, the goto target jumped
directly to err_free_context_registers, skipping pm_runtime_disable()
despite pm_runtime having already been enabled earlier in the function.
Fix these issues by:
- Adding an err_release_mem label at the end of the error chain so all
post-init failure paths release the reserved memory association.
- Splitting pm_runtime_disable() into its own err_runtime_disable label
so the media frameworks init failure correctly unwinds it.
- Adding of_reserved_mem_device_release() and pm_runtime_disable() to
mali_c55_remove(), with the teardown order mirroring probe in
reverse.
Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
Signed-off-by: David Carlier <devnexen@gmail.com>
---
.../media/platform/arm/mali-c55/mali-c55-core.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-core.c b/drivers/media/platform/arm/mali-c55/mali-c55-core.c
index c1a562cd214e..bfe811182cda 100644
--- a/drivers/media/platform/arm/mali-c55/mali-c55-core.c
+++ b/drivers/media/platform/arm/mali-c55/mali-c55-core.c
@@ -806,8 +806,10 @@ static int mali_c55_probe(struct platform_device *pdev)
vb2_dma_contig_set_max_seg_size(dev, UINT_MAX);
ret = __mali_c55_power_on(mali_c55);
- if (ret)
- return dev_err_probe(dev, ret, "failed to power on\n");
+ if (ret) {
+ dev_err_probe(dev, ret, "failed to power on\n");
+ goto err_release_mem;
+ }
ret = mali_c55_check_hwcfg(mali_c55);
if (ret)
@@ -826,7 +828,7 @@ static int mali_c55_probe(struct platform_device *pdev)
ret = mali_c55_media_frameworks_init(mali_c55);
if (ret)
- goto err_free_context_registers;
+ goto err_runtime_disable;
pm_runtime_idle(&pdev->dev);
@@ -841,11 +843,14 @@ static int mali_c55_probe(struct platform_device *pdev)
err_deinit_media_frameworks:
mali_c55_media_frameworks_deinit(mali_c55);
+err_runtime_disable:
pm_runtime_disable(&pdev->dev);
err_free_context_registers:
kfree(mali_c55->context.registers);
err_power_off:
__mali_c55_power_off(mali_c55);
+err_release_mem:
+ of_reserved_mem_device_release(dev);
return ret;
}
@@ -854,8 +859,10 @@ static void mali_c55_remove(struct platform_device *pdev)
{
struct mali_c55 *mali_c55 = platform_get_drvdata(pdev);
- kfree(mali_c55->context.registers);
mali_c55_media_frameworks_deinit(mali_c55);
+ pm_runtime_disable(&pdev->dev);
+ kfree(mali_c55->context.registers);
+ of_reserved_mem_device_release(&pdev->dev);
}
static const struct of_device_id mali_c55_of_match[] = {
--
2.53.0
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [PATCH] media: mali-c55: fix resource leaks in probe and remove
2026-03-26 19:00 [PATCH] media: mali-c55: fix resource leaks in probe and remove David Carlier
@ 2026-03-26 20:33 ` David Carlier
2026-03-26 22:06 ` Dan Scally
2026-03-27 13:51 ` Jacopo Mondi
2026-03-27 4:29 ` kernel test robot
2026-03-27 6:05 ` kernel test robot
2 siblings, 2 replies; 7+ messages in thread
From: David Carlier @ 2026-03-26 20:33 UTC (permalink / raw)
To: Daniel Scally, Jacopo Mondi, Mauro Carvalho Chehab,
Nayden Kanchev, Hans Verkuil
Cc: linux-media, David Carlier
mali_c55_probe() calls of_reserved_mem_device_init() to associate
reserved memory regions with the device. This function allocates a
struct rmem_assigned_device and adds it to a global linked list, which
must be explicitly released via of_reserved_mem_device_release() — there
is no devm variant of this API.
However, neither the probe error paths nor mali_c55_remove() called
of_reserved_mem_device_release(). Any probe failure after the
of_reserved_mem_device_init() call, as well as every normal device
removal, leaked the reserved memory association on the global list.
Additionally, pm_runtime_enable() called during probe was never undone
in mali_c55_remove(), leaving the device's runtime PM state enabled
after the driver is unbound. The probe error path had a related issue:
when mali_c55_media_frameworks_init() failed, the goto target jumped
directly to err_free_context_registers, skipping pm_runtime_disable()
despite pm_runtime having already been enabled earlier in the function.
Fix these issues by:
- Adding an err_release_mem label at the end of the error chain so all
post-init failure paths release the reserved memory association.
- Splitting pm_runtime_disable() into its own err_runtime_disable label
so the media frameworks init failure correctly unwinds it.
- Adding of_reserved_mem_device_release() and pm_runtime_disable() to
mali_c55_remove(), with the teardown order mirroring probe in
reverse.
Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
Signed-off-by: David Carlier <devnexen@gmail.com>
---
.../media/platform/arm/mali-c55/mali-c55-core.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-core.c b/drivers/media/platform/arm/mali-c55/mali-c55-core.c
index c1a562cd214e..de895b69d786 100644
--- a/drivers/media/platform/arm/mali-c55/mali-c55-core.c
+++ b/drivers/media/platform/arm/mali-c55/mali-c55-core.c
@@ -806,8 +806,10 @@ static int mali_c55_probe(struct platform_device *pdev)
vb2_dma_contig_set_max_seg_size(dev, UINT_MAX);
ret = __mali_c55_power_on(mali_c55);
- if (ret)
- return dev_err_probe(dev, ret, "failed to power on\n");
+ if (ret) {
+ dev_err_probe(dev, ret, "failed to power on\n");
+ goto err_release_mem;
+ }
ret = mali_c55_check_hwcfg(mali_c55);
if (ret)
@@ -826,7 +828,7 @@ static int mali_c55_probe(struct platform_device *pdev)
ret = mali_c55_media_frameworks_init(mali_c55);
if (ret)
- goto err_free_context_registers;
+ goto err_runtime_disable;
pm_runtime_idle(&pdev->dev);
@@ -841,11 +843,13 @@ static int mali_c55_probe(struct platform_device *pdev)
err_deinit_media_frameworks:
mali_c55_media_frameworks_deinit(mali_c55);
+err_runtime_disable:
pm_runtime_disable(&pdev->dev);
-err_free_context_registers:
kfree(mali_c55->context.registers);
err_power_off:
__mali_c55_power_off(mali_c55);
+err_release_mem:
+ of_reserved_mem_device_release(dev);
return ret;
}
@@ -854,8 +858,10 @@ static void mali_c55_remove(struct platform_device *pdev)
{
struct mali_c55 *mali_c55 = platform_get_drvdata(pdev);
- kfree(mali_c55->context.registers);
mali_c55_media_frameworks_deinit(mali_c55);
+ pm_runtime_disable(&pdev->dev);
+ kfree(mali_c55->context.registers);
+ of_reserved_mem_device_release(&pdev->dev);
}
static const struct of_device_id mali_c55_of_match[] = {
--
2.53.0
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH] media: mali-c55: fix resource leaks in probe and remove
2026-03-26 20:33 ` David Carlier
@ 2026-03-26 22:06 ` Dan Scally
2026-03-27 13:51 ` Jacopo Mondi
1 sibling, 0 replies; 7+ messages in thread
From: Dan Scally @ 2026-03-26 22:06 UTC (permalink / raw)
To: David Carlier, Jacopo Mondi, Mauro Carvalho Chehab,
Nayden Kanchev, Hans Verkuil
Cc: linux-media
Hi David - thanks for the patch
On 26/03/2026 20:33, David Carlier wrote:
> mali_c55_probe() calls of_reserved_mem_device_init() to associate
> reserved memory regions with the device. This function allocates a
> struct rmem_assigned_device and adds it to a global linked list, which
> must be explicitly released via of_reserved_mem_device_release() — there
> is no devm variant of this API.
>
> However, neither the probe error paths nor mali_c55_remove() called
> of_reserved_mem_device_release(). Any probe failure after the
> of_reserved_mem_device_init() call, as well as every normal device
> removal, leaked the reserved memory association on the global list.
>
> Additionally, pm_runtime_enable() called during probe was never undone
> in mali_c55_remove(), leaving the device's runtime PM state enabled
> after the driver is unbound. The probe error path had a related issue:
> when mali_c55_media_frameworks_init() failed, the goto target jumped
> directly to err_free_context_registers, skipping pm_runtime_disable()
> despite pm_runtime having already been enabled earlier in the function.
>
> Fix these issues by:
> - Adding an err_release_mem label at the end of the error chain so all
> post-init failure paths release the reserved memory association.
> - Splitting pm_runtime_disable() into its own err_runtime_disable label
> so the media frameworks init failure correctly unwinds it.
> - Adding of_reserved_mem_device_release() and pm_runtime_disable() to
> mali_c55_remove(), with the teardown order mirroring probe in
> reverse.
>
> Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
> Signed-off-by: David Carlier <devnexen@gmail.com>
This all looks good to me - thank you for catching the problems
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
> ---
> .../media/platform/arm/mali-c55/mali-c55-core.c | 16 +++++++++++-----
> 1 file changed, 11 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-core.c b/drivers/media/platform/arm/mali-c55/mali-c55-core.c
> index c1a562cd214e..de895b69d786 100644
> --- a/drivers/media/platform/arm/mali-c55/mali-c55-core.c
> +++ b/drivers/media/platform/arm/mali-c55/mali-c55-core.c
> @@ -806,8 +806,10 @@ static int mali_c55_probe(struct platform_device *pdev)
> vb2_dma_contig_set_max_seg_size(dev, UINT_MAX);
>
> ret = __mali_c55_power_on(mali_c55);
> - if (ret)
> - return dev_err_probe(dev, ret, "failed to power on\n");
> + if (ret) {
> + dev_err_probe(dev, ret, "failed to power on\n");
> + goto err_release_mem;
> + }
>
> ret = mali_c55_check_hwcfg(mali_c55);
> if (ret)
> @@ -826,7 +828,7 @@ static int mali_c55_probe(struct platform_device *pdev)
>
> ret = mali_c55_media_frameworks_init(mali_c55);
> if (ret)
> - goto err_free_context_registers;
> + goto err_runtime_disable;
>
> pm_runtime_idle(&pdev->dev);
>
> @@ -841,11 +843,13 @@ static int mali_c55_probe(struct platform_device *pdev)
>
> err_deinit_media_frameworks:
> mali_c55_media_frameworks_deinit(mali_c55);
> +err_runtime_disable:
> pm_runtime_disable(&pdev->dev);
> -err_free_context_registers:
> kfree(mali_c55->context.registers);
> err_power_off:
> __mali_c55_power_off(mali_c55);
> +err_release_mem:
> + of_reserved_mem_device_release(dev);
>
> return ret;
> }
> @@ -854,8 +858,10 @@ static void mali_c55_remove(struct platform_device *pdev)
> {
> struct mali_c55 *mali_c55 = platform_get_drvdata(pdev);
>
> - kfree(mali_c55->context.registers);
> mali_c55_media_frameworks_deinit(mali_c55);
> + pm_runtime_disable(&pdev->dev);
> + kfree(mali_c55->context.registers);
> + of_reserved_mem_device_release(&pdev->dev);
> }
>
> static const struct of_device_id mali_c55_of_match[] = {
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] media: mali-c55: fix resource leaks in probe and remove
2026-03-26 19:00 [PATCH] media: mali-c55: fix resource leaks in probe and remove David Carlier
2026-03-26 20:33 ` David Carlier
@ 2026-03-27 4:29 ` kernel test robot
2026-03-27 6:05 ` kernel test robot
2 siblings, 0 replies; 7+ messages in thread
From: kernel test robot @ 2026-03-27 4:29 UTC (permalink / raw)
To: David Carlier, Daniel Scally, Jacopo Mondi, Mauro Carvalho Chehab,
Nayden Kanchev, Hans Verkuil
Cc: oe-kbuild-all, linux-media, David Carlier
Hi David,
kernel test robot noticed the following build warnings:
[auto build test WARNING on media-tree/master]
[also build test WARNING on linus/master v7.0-rc5 next-20260326]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/David-Carlier/media-mali-c55-fix-resource-leaks-in-probe-and-remove/20260327-045201
base: git://linuxtv.org/media_tree.git master
patch link: https://lore.kernel.org/r/20260326190052.11780-1-devnexen%40gmail.com
patch subject: [PATCH] media: mali-c55: fix resource leaks in probe and remove
config: nios2-allmodconfig (https://download.01.org/0day-ci/archive/20260327/202603271219.b8QddrPS-lkp@intel.com/config)
compiler: nios2-linux-gcc (GCC) 11.5.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260327/202603271219.b8QddrPS-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202603271219.b8QddrPS-lkp@intel.com/
All warnings (new ones prefixed by >>):
drivers/media/platform/arm/mali-c55/mali-c55-core.c: In function 'mali_c55_probe':
>> drivers/media/platform/arm/mali-c55/mali-c55-core.c:883:1: warning: label 'err_free_context_registers' defined but not used [-Wunused-label]
883 | err_free_context_registers:
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
vim +/err_free_context_registers +883 drivers/media/platform/arm/mali-c55/mali-c55-core.c
d5f281f3dd2988 Daniel Scally 2025-11-11 804
d5f281f3dd2988 Daniel Scally 2025-11-11 805 static int mali_c55_probe(struct platform_device *pdev)
d5f281f3dd2988 Daniel Scally 2025-11-11 806 {
d5f281f3dd2988 Daniel Scally 2025-11-11 807 struct device *dev = &pdev->dev;
d5f281f3dd2988 Daniel Scally 2025-11-11 808 struct mali_c55 *mali_c55;
d5f281f3dd2988 Daniel Scally 2025-11-11 809 struct resource *res;
d5f281f3dd2988 Daniel Scally 2025-11-11 810 int ret;
d5f281f3dd2988 Daniel Scally 2025-11-11 811
d5f281f3dd2988 Daniel Scally 2025-11-11 812 mali_c55 = devm_kzalloc(dev, sizeof(*mali_c55), GFP_KERNEL);
d5f281f3dd2988 Daniel Scally 2025-11-11 813 if (!mali_c55)
d5f281f3dd2988 Daniel Scally 2025-11-11 814 return -ENOMEM;
d5f281f3dd2988 Daniel Scally 2025-11-11 815
d5f281f3dd2988 Daniel Scally 2025-11-11 816 mali_c55->dev = dev;
d5f281f3dd2988 Daniel Scally 2025-11-11 817 platform_set_drvdata(pdev, mali_c55);
d5f281f3dd2988 Daniel Scally 2025-11-11 818
d5f281f3dd2988 Daniel Scally 2025-11-11 819 mali_c55->base = devm_platform_get_and_ioremap_resource(pdev, 0,
d5f281f3dd2988 Daniel Scally 2025-11-11 820 &res);
d5f281f3dd2988 Daniel Scally 2025-11-11 821 if (IS_ERR(mali_c55->base))
d5f281f3dd2988 Daniel Scally 2025-11-11 822 return dev_err_probe(dev, PTR_ERR(mali_c55->base),
d5f281f3dd2988 Daniel Scally 2025-11-11 823 "failed to map IO memory\n");
d5f281f3dd2988 Daniel Scally 2025-11-11 824
d5f281f3dd2988 Daniel Scally 2025-11-11 825 for (unsigned int i = 0; i < ARRAY_SIZE(mali_c55_clk_names); i++)
d5f281f3dd2988 Daniel Scally 2025-11-11 826 mali_c55->clks[i].id = mali_c55_clk_names[i];
d5f281f3dd2988 Daniel Scally 2025-11-11 827
d5f281f3dd2988 Daniel Scally 2025-11-11 828 ret = devm_clk_bulk_get(dev, ARRAY_SIZE(mali_c55->clks), mali_c55->clks);
d5f281f3dd2988 Daniel Scally 2025-11-11 829 if (ret)
d5f281f3dd2988 Daniel Scally 2025-11-11 830 return dev_err_probe(dev, ret, "failed to acquire clocks\n");
d5f281f3dd2988 Daniel Scally 2025-11-11 831
d5f281f3dd2988 Daniel Scally 2025-11-11 832 for (unsigned int i = 0; i < ARRAY_SIZE(mali_c55_reset_names); i++)
d5f281f3dd2988 Daniel Scally 2025-11-11 833 mali_c55->resets[i].id = mali_c55_reset_names[i];
d5f281f3dd2988 Daniel Scally 2025-11-11 834
d5f281f3dd2988 Daniel Scally 2025-11-11 835 ret = devm_reset_control_bulk_get_optional_shared(dev,
d5f281f3dd2988 Daniel Scally 2025-11-11 836 ARRAY_SIZE(mali_c55_reset_names), mali_c55->resets);
d5f281f3dd2988 Daniel Scally 2025-11-11 837 if (ret)
d5f281f3dd2988 Daniel Scally 2025-11-11 838 return dev_err_probe(dev, ret, "failed to acquire resets\n");
d5f281f3dd2988 Daniel Scally 2025-11-11 839
d5f281f3dd2988 Daniel Scally 2025-11-11 840 of_reserved_mem_device_init(dev);
d5f281f3dd2988 Daniel Scally 2025-11-11 841 vb2_dma_contig_set_max_seg_size(dev, UINT_MAX);
d5f281f3dd2988 Daniel Scally 2025-11-11 842
d5f281f3dd2988 Daniel Scally 2025-11-11 843 ret = __mali_c55_power_on(mali_c55);
3b2d04fb011b8b David Carlier 2026-03-26 844 if (ret) {
3b2d04fb011b8b David Carlier 2026-03-26 845 dev_err_probe(dev, ret, "failed to power on\n");
3b2d04fb011b8b David Carlier 2026-03-26 846 goto err_release_mem;
3b2d04fb011b8b David Carlier 2026-03-26 847 }
d5f281f3dd2988 Daniel Scally 2025-11-11 848
d5f281f3dd2988 Daniel Scally 2025-11-11 849 ret = mali_c55_check_hwcfg(mali_c55);
d5f281f3dd2988 Daniel Scally 2025-11-11 850 if (ret)
d5f281f3dd2988 Daniel Scally 2025-11-11 851 goto err_power_off;
d5f281f3dd2988 Daniel Scally 2025-11-11 852
d5f281f3dd2988 Daniel Scally 2025-11-11 853 ret = mali_c55_init_context(mali_c55, res);
d5f281f3dd2988 Daniel Scally 2025-11-11 854 if (ret)
d5f281f3dd2988 Daniel Scally 2025-11-11 855 goto err_power_off;
d5f281f3dd2988 Daniel Scally 2025-11-11 856
d5f281f3dd2988 Daniel Scally 2025-11-11 857 mali_c55->media_dev.dev = dev;
d5f281f3dd2988 Daniel Scally 2025-11-11 858
d5f281f3dd2988 Daniel Scally 2025-11-11 859 pm_runtime_set_autosuspend_delay(&pdev->dev, 2000);
d5f281f3dd2988 Daniel Scally 2025-11-11 860 pm_runtime_use_autosuspend(&pdev->dev);
d5f281f3dd2988 Daniel Scally 2025-11-11 861 pm_runtime_set_active(&pdev->dev);
d5f281f3dd2988 Daniel Scally 2025-11-11 862 pm_runtime_enable(&pdev->dev);
d5f281f3dd2988 Daniel Scally 2025-11-11 863
d5f281f3dd2988 Daniel Scally 2025-11-11 864 ret = mali_c55_media_frameworks_init(mali_c55);
d5f281f3dd2988 Daniel Scally 2025-11-11 865 if (ret)
3b2d04fb011b8b David Carlier 2026-03-26 866 goto err_runtime_disable;
d5f281f3dd2988 Daniel Scally 2025-11-11 867
d5f281f3dd2988 Daniel Scally 2025-11-11 868 pm_runtime_idle(&pdev->dev);
d5f281f3dd2988 Daniel Scally 2025-11-11 869
d5f281f3dd2988 Daniel Scally 2025-11-11 870 mali_c55->irqnum = platform_get_irq(pdev, 0);
d5f281f3dd2988 Daniel Scally 2025-11-11 871 if (mali_c55->irqnum < 0) {
d5f281f3dd2988 Daniel Scally 2025-11-11 872 ret = mali_c55->irqnum;
d5f281f3dd2988 Daniel Scally 2025-11-11 873 dev_err(dev, "failed to get interrupt\n");
d5f281f3dd2988 Daniel Scally 2025-11-11 874 goto err_deinit_media_frameworks;
d5f281f3dd2988 Daniel Scally 2025-11-11 875 }
d5f281f3dd2988 Daniel Scally 2025-11-11 876
d5f281f3dd2988 Daniel Scally 2025-11-11 877 return 0;
d5f281f3dd2988 Daniel Scally 2025-11-11 878
d5f281f3dd2988 Daniel Scally 2025-11-11 879 err_deinit_media_frameworks:
d5f281f3dd2988 Daniel Scally 2025-11-11 880 mali_c55_media_frameworks_deinit(mali_c55);
3b2d04fb011b8b David Carlier 2026-03-26 881 err_runtime_disable:
d5f281f3dd2988 Daniel Scally 2025-11-11 882 pm_runtime_disable(&pdev->dev);
d5f281f3dd2988 Daniel Scally 2025-11-11 @883 err_free_context_registers:
d5f281f3dd2988 Daniel Scally 2025-11-11 884 kfree(mali_c55->context.registers);
d5f281f3dd2988 Daniel Scally 2025-11-11 885 err_power_off:
d5f281f3dd2988 Daniel Scally 2025-11-11 886 __mali_c55_power_off(mali_c55);
3b2d04fb011b8b David Carlier 2026-03-26 887 err_release_mem:
3b2d04fb011b8b David Carlier 2026-03-26 888 of_reserved_mem_device_release(dev);
d5f281f3dd2988 Daniel Scally 2025-11-11 889
d5f281f3dd2988 Daniel Scally 2025-11-11 890 return ret;
d5f281f3dd2988 Daniel Scally 2025-11-11 891 }
d5f281f3dd2988 Daniel Scally 2025-11-11 892
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] media: mali-c55: fix resource leaks in probe and remove
2026-03-26 19:00 [PATCH] media: mali-c55: fix resource leaks in probe and remove David Carlier
2026-03-26 20:33 ` David Carlier
2026-03-27 4:29 ` kernel test robot
@ 2026-03-27 6:05 ` kernel test robot
2 siblings, 0 replies; 7+ messages in thread
From: kernel test robot @ 2026-03-27 6:05 UTC (permalink / raw)
To: David Carlier, Daniel Scally, Jacopo Mondi, Mauro Carvalho Chehab,
Nayden Kanchev, Hans Verkuil
Cc: llvm, oe-kbuild-all, linux-media, David Carlier
Hi David,
kernel test robot noticed the following build warnings:
[auto build test WARNING on media-tree/master]
[also build test WARNING on linus/master v7.0-rc5 next-20260326]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/David-Carlier/media-mali-c55-fix-resource-leaks-in-probe-and-remove/20260327-045201
base: git://linuxtv.org/media_tree.git master
patch link: https://lore.kernel.org/r/20260326190052.11780-1-devnexen%40gmail.com
patch subject: [PATCH] media: mali-c55: fix resource leaks in probe and remove
config: sparc64-allmodconfig (https://download.01.org/0day-ci/archive/20260327/202603271400.K56xZKaE-lkp@intel.com/config)
compiler: clang version 23.0.0git (https://github.com/llvm/llvm-project 054e11d1a17e5ba88bb1a8ef32fad3346e80b186)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260327/202603271400.K56xZKaE-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202603271400.K56xZKaE-lkp@intel.com/
All warnings (new ones prefixed by >>):
>> drivers/media/platform/arm/mali-c55/mali-c55-core.c:883:1: warning: unused label 'err_free_context_registers' [-Wunused-label]
883 | err_free_context_registers:
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
vim +/err_free_context_registers +883 drivers/media/platform/arm/mali-c55/mali-c55-core.c
d5f281f3dd2988 Daniel Scally 2025-11-11 804
d5f281f3dd2988 Daniel Scally 2025-11-11 805 static int mali_c55_probe(struct platform_device *pdev)
d5f281f3dd2988 Daniel Scally 2025-11-11 806 {
d5f281f3dd2988 Daniel Scally 2025-11-11 807 struct device *dev = &pdev->dev;
d5f281f3dd2988 Daniel Scally 2025-11-11 808 struct mali_c55 *mali_c55;
d5f281f3dd2988 Daniel Scally 2025-11-11 809 struct resource *res;
d5f281f3dd2988 Daniel Scally 2025-11-11 810 int ret;
d5f281f3dd2988 Daniel Scally 2025-11-11 811
d5f281f3dd2988 Daniel Scally 2025-11-11 812 mali_c55 = devm_kzalloc(dev, sizeof(*mali_c55), GFP_KERNEL);
d5f281f3dd2988 Daniel Scally 2025-11-11 813 if (!mali_c55)
d5f281f3dd2988 Daniel Scally 2025-11-11 814 return -ENOMEM;
d5f281f3dd2988 Daniel Scally 2025-11-11 815
d5f281f3dd2988 Daniel Scally 2025-11-11 816 mali_c55->dev = dev;
d5f281f3dd2988 Daniel Scally 2025-11-11 817 platform_set_drvdata(pdev, mali_c55);
d5f281f3dd2988 Daniel Scally 2025-11-11 818
d5f281f3dd2988 Daniel Scally 2025-11-11 819 mali_c55->base = devm_platform_get_and_ioremap_resource(pdev, 0,
d5f281f3dd2988 Daniel Scally 2025-11-11 820 &res);
d5f281f3dd2988 Daniel Scally 2025-11-11 821 if (IS_ERR(mali_c55->base))
d5f281f3dd2988 Daniel Scally 2025-11-11 822 return dev_err_probe(dev, PTR_ERR(mali_c55->base),
d5f281f3dd2988 Daniel Scally 2025-11-11 823 "failed to map IO memory\n");
d5f281f3dd2988 Daniel Scally 2025-11-11 824
d5f281f3dd2988 Daniel Scally 2025-11-11 825 for (unsigned int i = 0; i < ARRAY_SIZE(mali_c55_clk_names); i++)
d5f281f3dd2988 Daniel Scally 2025-11-11 826 mali_c55->clks[i].id = mali_c55_clk_names[i];
d5f281f3dd2988 Daniel Scally 2025-11-11 827
d5f281f3dd2988 Daniel Scally 2025-11-11 828 ret = devm_clk_bulk_get(dev, ARRAY_SIZE(mali_c55->clks), mali_c55->clks);
d5f281f3dd2988 Daniel Scally 2025-11-11 829 if (ret)
d5f281f3dd2988 Daniel Scally 2025-11-11 830 return dev_err_probe(dev, ret, "failed to acquire clocks\n");
d5f281f3dd2988 Daniel Scally 2025-11-11 831
d5f281f3dd2988 Daniel Scally 2025-11-11 832 for (unsigned int i = 0; i < ARRAY_SIZE(mali_c55_reset_names); i++)
d5f281f3dd2988 Daniel Scally 2025-11-11 833 mali_c55->resets[i].id = mali_c55_reset_names[i];
d5f281f3dd2988 Daniel Scally 2025-11-11 834
d5f281f3dd2988 Daniel Scally 2025-11-11 835 ret = devm_reset_control_bulk_get_optional_shared(dev,
d5f281f3dd2988 Daniel Scally 2025-11-11 836 ARRAY_SIZE(mali_c55_reset_names), mali_c55->resets);
d5f281f3dd2988 Daniel Scally 2025-11-11 837 if (ret)
d5f281f3dd2988 Daniel Scally 2025-11-11 838 return dev_err_probe(dev, ret, "failed to acquire resets\n");
d5f281f3dd2988 Daniel Scally 2025-11-11 839
d5f281f3dd2988 Daniel Scally 2025-11-11 840 of_reserved_mem_device_init(dev);
d5f281f3dd2988 Daniel Scally 2025-11-11 841 vb2_dma_contig_set_max_seg_size(dev, UINT_MAX);
d5f281f3dd2988 Daniel Scally 2025-11-11 842
d5f281f3dd2988 Daniel Scally 2025-11-11 843 ret = __mali_c55_power_on(mali_c55);
3b2d04fb011b8b David Carlier 2026-03-26 844 if (ret) {
3b2d04fb011b8b David Carlier 2026-03-26 845 dev_err_probe(dev, ret, "failed to power on\n");
3b2d04fb011b8b David Carlier 2026-03-26 846 goto err_release_mem;
3b2d04fb011b8b David Carlier 2026-03-26 847 }
d5f281f3dd2988 Daniel Scally 2025-11-11 848
d5f281f3dd2988 Daniel Scally 2025-11-11 849 ret = mali_c55_check_hwcfg(mali_c55);
d5f281f3dd2988 Daniel Scally 2025-11-11 850 if (ret)
d5f281f3dd2988 Daniel Scally 2025-11-11 851 goto err_power_off;
d5f281f3dd2988 Daniel Scally 2025-11-11 852
d5f281f3dd2988 Daniel Scally 2025-11-11 853 ret = mali_c55_init_context(mali_c55, res);
d5f281f3dd2988 Daniel Scally 2025-11-11 854 if (ret)
d5f281f3dd2988 Daniel Scally 2025-11-11 855 goto err_power_off;
d5f281f3dd2988 Daniel Scally 2025-11-11 856
d5f281f3dd2988 Daniel Scally 2025-11-11 857 mali_c55->media_dev.dev = dev;
d5f281f3dd2988 Daniel Scally 2025-11-11 858
d5f281f3dd2988 Daniel Scally 2025-11-11 859 pm_runtime_set_autosuspend_delay(&pdev->dev, 2000);
d5f281f3dd2988 Daniel Scally 2025-11-11 860 pm_runtime_use_autosuspend(&pdev->dev);
d5f281f3dd2988 Daniel Scally 2025-11-11 861 pm_runtime_set_active(&pdev->dev);
d5f281f3dd2988 Daniel Scally 2025-11-11 862 pm_runtime_enable(&pdev->dev);
d5f281f3dd2988 Daniel Scally 2025-11-11 863
d5f281f3dd2988 Daniel Scally 2025-11-11 864 ret = mali_c55_media_frameworks_init(mali_c55);
d5f281f3dd2988 Daniel Scally 2025-11-11 865 if (ret)
3b2d04fb011b8b David Carlier 2026-03-26 866 goto err_runtime_disable;
d5f281f3dd2988 Daniel Scally 2025-11-11 867
d5f281f3dd2988 Daniel Scally 2025-11-11 868 pm_runtime_idle(&pdev->dev);
d5f281f3dd2988 Daniel Scally 2025-11-11 869
d5f281f3dd2988 Daniel Scally 2025-11-11 870 mali_c55->irqnum = platform_get_irq(pdev, 0);
d5f281f3dd2988 Daniel Scally 2025-11-11 871 if (mali_c55->irqnum < 0) {
d5f281f3dd2988 Daniel Scally 2025-11-11 872 ret = mali_c55->irqnum;
d5f281f3dd2988 Daniel Scally 2025-11-11 873 dev_err(dev, "failed to get interrupt\n");
d5f281f3dd2988 Daniel Scally 2025-11-11 874 goto err_deinit_media_frameworks;
d5f281f3dd2988 Daniel Scally 2025-11-11 875 }
d5f281f3dd2988 Daniel Scally 2025-11-11 876
d5f281f3dd2988 Daniel Scally 2025-11-11 877 return 0;
d5f281f3dd2988 Daniel Scally 2025-11-11 878
d5f281f3dd2988 Daniel Scally 2025-11-11 879 err_deinit_media_frameworks:
d5f281f3dd2988 Daniel Scally 2025-11-11 880 mali_c55_media_frameworks_deinit(mali_c55);
3b2d04fb011b8b David Carlier 2026-03-26 881 err_runtime_disable:
d5f281f3dd2988 Daniel Scally 2025-11-11 882 pm_runtime_disable(&pdev->dev);
d5f281f3dd2988 Daniel Scally 2025-11-11 @883 err_free_context_registers:
d5f281f3dd2988 Daniel Scally 2025-11-11 884 kfree(mali_c55->context.registers);
d5f281f3dd2988 Daniel Scally 2025-11-11 885 err_power_off:
d5f281f3dd2988 Daniel Scally 2025-11-11 886 __mali_c55_power_off(mali_c55);
3b2d04fb011b8b David Carlier 2026-03-26 887 err_release_mem:
3b2d04fb011b8b David Carlier 2026-03-26 888 of_reserved_mem_device_release(dev);
d5f281f3dd2988 Daniel Scally 2025-11-11 889
d5f281f3dd2988 Daniel Scally 2025-11-11 890 return ret;
d5f281f3dd2988 Daniel Scally 2025-11-11 891 }
d5f281f3dd2988 Daniel Scally 2025-11-11 892
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] media: mali-c55: fix resource leaks in probe and remove
2026-03-26 20:33 ` David Carlier
2026-03-26 22:06 ` Dan Scally
@ 2026-03-27 13:51 ` Jacopo Mondi
2026-03-27 15:01 ` David CARLIER
1 sibling, 1 reply; 7+ messages in thread
From: Jacopo Mondi @ 2026-03-27 13:51 UTC (permalink / raw)
To: David Carlier
Cc: Daniel Scally, Jacopo Mondi, Mauro Carvalho Chehab,
Nayden Kanchev, Hans Verkuil, linux-media
Hello David
first of all, there are two version of this patch, one sent in
response the the other. Which one should I look at ?
If you intended to send a v2, mark it as v2 (depending on the tooling
you use either let b4 handle it or use -vX switch to
git-format-patches) and send it out -not- in reply to the first
version.
On Thu, Mar 26, 2026 at 08:33:39PM +0000, David Carlier wrote:
> mali_c55_probe() calls of_reserved_mem_device_init() to associate
> reserved memory regions with the device. This function allocates a
> struct rmem_assigned_device and adds it to a global linked list, which
> must be explicitly released via of_reserved_mem_device_release() — there
> is no devm variant of this API.
>
> However, neither the probe error paths nor mali_c55_remove() called
> of_reserved_mem_device_release(). Any probe failure after the
> of_reserved_mem_device_init() call, as well as every normal device
> removal, leaked the reserved memory association on the global list.
Thanks! The of_reserved_mem_device_ APIs documentation is -horrible-.
It tells you what the functions do but not how the API should be
used. I can only resort of the fact that a _release() should
logically follow an _init()...
>
> Additionally, pm_runtime_enable() called during probe was never undone
> in mali_c55_remove(), leaving the device's runtime PM state enabled
Ok, but this is a separate patch
> after the driver is unbound. The probe error path had a related issue:
> when mali_c55_media_frameworks_init() failed, the goto target jumped
> directly to err_free_context_registers, skipping pm_runtime_disable()
> despite pm_runtime having already been enabled earlier in the function.
Ups, yes.
A separate patch as well please.
>
> Fix these issues by:
> - Adding an err_release_mem label at the end of the error chain so all
> post-init failure paths release the reserved memory association.
> - Splitting pm_runtime_disable() into its own err_runtime_disable label
> so the media frameworks init failure correctly unwinds it.
> - Adding of_reserved_mem_device_release() and pm_runtime_disable() to
> mali_c55_remove(), with the teardown order mirroring probe in
> reverse.
>
> Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
> Signed-off-by: David Carlier <devnexen@gmail.com>
> ---
> .../media/platform/arm/mali-c55/mali-c55-core.c | 16 +++++++++++-----
> 1 file changed, 11 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-core.c b/drivers/media/platform/arm/mali-c55/mali-c55-core.c
> index c1a562cd214e..de895b69d786 100644
> --- a/drivers/media/platform/arm/mali-c55/mali-c55-core.c
> +++ b/drivers/media/platform/arm/mali-c55/mali-c55-core.c
> @@ -806,8 +806,10 @@ static int mali_c55_probe(struct platform_device *pdev)
> vb2_dma_contig_set_max_seg_size(dev, UINT_MAX);
>
> ret = __mali_c55_power_on(mali_c55);
> - if (ret)
> - return dev_err_probe(dev, ret, "failed to power on\n");
> + if (ret) {
> + dev_err_probe(dev, ret, "failed to power on\n");
> + goto err_release_mem;
> + }
>
> ret = mali_c55_check_hwcfg(mali_c55);
> if (ret)
> @@ -826,7 +828,7 @@ static int mali_c55_probe(struct platform_device *pdev)
>
> ret = mali_c55_media_frameworks_init(mali_c55);
> if (ret)
> - goto err_free_context_registers;
> + goto err_runtime_disable;
>
> pm_runtime_idle(&pdev->dev);
>
> @@ -841,11 +843,13 @@ static int mali_c55_probe(struct platform_device *pdev)
>
> err_deinit_media_frameworks:
> mali_c55_media_frameworks_deinit(mali_c55);
> +err_runtime_disable:
maybe err_pm_runtime_disable
> pm_runtime_disable(&pdev->dev);
> -err_free_context_registers:
> kfree(mali_c55->context.registers);
> err_power_off:
> __mali_c55_power_off(mali_c55);
> +err_release_mem:
> + of_reserved_mem_device_release(dev);
>
> return ret;
> }
> @@ -854,8 +858,10 @@ static void mali_c55_remove(struct platform_device *pdev)
> {
> struct mali_c55 *mali_c55 = platform_get_drvdata(pdev);
>
> - kfree(mali_c55->context.registers);
> mali_c55_media_frameworks_deinit(mali_c55);
> + pm_runtime_disable(&pdev->dev);
> + kfree(mali_c55->context.registers);
> + of_reserved_mem_device_release(&pdev->dev);
This patched prompted me to looking into module load/unload more
closely and indeed there are more things to fix on top.
If you split this patch in three I'll take them in and work on top of
them. Would this work ?
Thanks
j
> }
>
> static const struct of_device_id mali_c55_of_match[] = {
> --
> 2.53.0
>
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] media: mali-c55: fix resource leaks in probe and remove
2026-03-27 13:51 ` Jacopo Mondi
@ 2026-03-27 15:01 ` David CARLIER
0 siblings, 0 replies; 7+ messages in thread
From: David CARLIER @ 2026-03-27 15:01 UTC (permalink / raw)
To: Jacopo Mondi
Cc: Daniel Scally, Mauro Carvalho Chehab, Nayden Kanchev,
Hans Verkuil, linux-media
Hi,
On Fri, 27 Mar 2026 at 13:51, Jacopo Mondi
<jacopo.mondi@ideasonboard.com> wrote:
>
> Hello David
>
> first of all, there are two version of this patch, one sent in
> response the the other. Which one should I look at ?
>
> If you intended to send a v2, mark it as v2 (depending on the tooling
> you use either let b4 handle it or use -vX switch to
> git-format-patches) and send it out -not- in reply to the first
> version.
>
> On Thu, Mar 26, 2026 at 08:33:39PM +0000, David Carlier wrote:
> > mali_c55_probe() calls of_reserved_mem_device_init() to associate
> > reserved memory regions with the device. This function allocates a
> > struct rmem_assigned_device and adds it to a global linked list, which
> > must be explicitly released via of_reserved_mem_device_release() — there
> > is no devm variant of this API.
> >
> > However, neither the probe error paths nor mali_c55_remove() called
> > of_reserved_mem_device_release(). Any probe failure after the
> > of_reserved_mem_device_init() call, as well as every normal device
> > removal, leaked the reserved memory association on the global list.
>
> Thanks! The of_reserved_mem_device_ APIs documentation is -horrible-.
>
> It tells you what the functions do but not how the API should be
> used. I can only resort of the fact that a _release() should
> logically follow an _init()...
>
> >
> > Additionally, pm_runtime_enable() called during probe was never undone
> > in mali_c55_remove(), leaving the device's runtime PM state enabled
>
> Ok, but this is a separate patch
>
> > after the driver is unbound. The probe error path had a related issue:
> > when mali_c55_media_frameworks_init() failed, the goto target jumped
> > directly to err_free_context_registers, skipping pm_runtime_disable()
> > despite pm_runtime having already been enabled earlier in the function.
>
> Ups, yes.
>
> A separate patch as well please.
>
> >
> > Fix these issues by:
> > - Adding an err_release_mem label at the end of the error chain so all
> > post-init failure paths release the reserved memory association.
> > - Splitting pm_runtime_disable() into its own err_runtime_disable label
> > so the media frameworks init failure correctly unwinds it.
> > - Adding of_reserved_mem_device_release() and pm_runtime_disable() to
> > mali_c55_remove(), with the teardown order mirroring probe in
> > reverse.
> >
> > Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
> > Signed-off-by: David Carlier <devnexen@gmail.com>
> > ---
> > .../media/platform/arm/mali-c55/mali-c55-core.c | 16 +++++++++++-----
> > 1 file changed, 11 insertions(+), 5 deletions(-)
> >
> > diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-core.c b/drivers/media/platform/arm/mali-c55/mali-c55-core.c
> > index c1a562cd214e..de895b69d786 100644
> > --- a/drivers/media/platform/arm/mali-c55/mali-c55-core.c
> > +++ b/drivers/media/platform/arm/mali-c55/mali-c55-core.c
> > @@ -806,8 +806,10 @@ static int mali_c55_probe(struct platform_device *pdev)
> > vb2_dma_contig_set_max_seg_size(dev, UINT_MAX);
> >
> > ret = __mali_c55_power_on(mali_c55);
> > - if (ret)
> > - return dev_err_probe(dev, ret, "failed to power on\n");
> > + if (ret) {
> > + dev_err_probe(dev, ret, "failed to power on\n");
> > + goto err_release_mem;
> > + }
> >
> > ret = mali_c55_check_hwcfg(mali_c55);
> > if (ret)
> > @@ -826,7 +828,7 @@ static int mali_c55_probe(struct platform_device *pdev)
> >
> > ret = mali_c55_media_frameworks_init(mali_c55);
> > if (ret)
> > - goto err_free_context_registers;
> > + goto err_runtime_disable;
> >
> > pm_runtime_idle(&pdev->dev);
> >
> > @@ -841,11 +843,13 @@ static int mali_c55_probe(struct platform_device *pdev)
> >
> > err_deinit_media_frameworks:
> > mali_c55_media_frameworks_deinit(mali_c55);
> > +err_runtime_disable:
>
> maybe err_pm_runtime_disable
>
> > pm_runtime_disable(&pdev->dev);
> > -err_free_context_registers:
> > kfree(mali_c55->context.registers);
> > err_power_off:
> > __mali_c55_power_off(mali_c55);
> > +err_release_mem:
> > + of_reserved_mem_device_release(dev);
> >
> > return ret;
> > }
> > @@ -854,8 +858,10 @@ static void mali_c55_remove(struct platform_device *pdev)
> > {
> > struct mali_c55 *mali_c55 = platform_get_drvdata(pdev);
> >
> > - kfree(mali_c55->context.registers);
> > mali_c55_media_frameworks_deinit(mali_c55);
> > + pm_runtime_disable(&pdev->dev);
> > + kfree(mali_c55->context.registers);
> > + of_reserved_mem_device_release(&pdev->dev);
>
> This patched prompted me to looking into module load/unload more
> closely and indeed there are more things to fix on top.
>
> If you split this patch in three I'll take them in and work on top of
> them. Would this work ?
Ok I m going to split no problems. Cheers.
>
> Thanks
> j
>
> > }
> >
> > static const struct of_device_id mali_c55_of_match[] = {
> > --
> > 2.53.0
> >
> >
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-03-27 15:01 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-26 19:00 [PATCH] media: mali-c55: fix resource leaks in probe and remove David Carlier
2026-03-26 20:33 ` David Carlier
2026-03-26 22:06 ` Dan Scally
2026-03-27 13:51 ` Jacopo Mondi
2026-03-27 15:01 ` David CARLIER
2026-03-27 4:29 ` kernel test robot
2026-03-27 6:05 ` kernel test robot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox