[PATCH] staging: media: atomisp: fix memory leak of raw_black_frame

Huihui Huang
2026-04-16T06:31:41Z

Our code analyzer reported a memory leak in
drivers/staging/media/atomisp/pci/atomisp_cmd.c.

In atomisp_fixed_pattern_table(), raw_black_frame is allocated by
atomisp_v4l2_framebuffer_to_css_frame(). If sh_css_set_black_frame()
fails, the function returns -ENOMEM directly without freeing
raw_black_frame. The allocated memory is only freed on the success
path.

My patch adds the missing ia_css_frame_free() call before the error
return, to free raw_black_frame when sh_css_set_black_frame() fails.

Signed-off-by: Huihui Huang <hhhuang@smu.edu.sg>
---
drivers/staging/media/atomisp/pci/atomisp_cmd.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/media/atomisp/pci/atomisp_cmd.c b/drivers/staging/media/atomisp/pci/atomisp_cmd.c
index fec369575..3cacf16cb 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_cmd.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_cmd.c
@@ -3365,8 +3365,10 @@ int atomisp_fixed_pattern_table(struct atomisp_sub_device *asd,
return ret;

if (sh_css_set_black_frame(asd->stream_env[ATOMISP_INPUT_STREAM_GENERAL].stream,
- raw_black_frame) != 0)
+ raw_black_frame) != 0) {
+ ia_css_frame_free(raw_black_frame);
return -ENOMEM;
+ }

ia_css_frame_free(raw_black_frame);
return ret;
--
2.50.1