On Thu Apr 16 21:24:50 2026 +0800, Huihui Huang wrote:
> There are memory leaks in
> drivers/staging/media/atomisp/pci/atomisp_compat_css20.c.
>
> In atomisp_css_allocate_stat_buffers(), s3a_map is allocated by
> ia_css_isp_3a_statistics_map_allocate() and its backing memory is
> mapped via hmm_vmap(). When dis_buf allocation fails, the error path
> frees s3a_data but does not unmap or free s3a_map. Similarly, when
> md_buf allocation fails, neither s3a_map nor dvs_map (and their hmm
> vmaps) are freed.
>
> Add the missing hmm_vunmap() and map free calls on both error paths,
> matching the cleanup order used in atomisp_css_free_3a_buffer() and
> atomisp_css_free_dis_buffer().
>
> Signed-off-by: Huihui Huang <[email protected]>
> Signed-off-by: Sakari Ailus <[email protected]>
Patch committed.
Thanks,
Sakari Ailus
drivers/staging/media/atomisp/pci/atomisp_compat_css20.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
---
diff --git a/drivers/staging/media/atomisp/pci/atomisp_compat_css20.c
b/drivers/staging/media/atomisp/pci/atomisp_compat_css20.c
index d2bacd1ffe7b..0ee52637ea30 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_compat_css20.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_compat_css20.c
@@ -1117,8 +1117,11 @@ int atomisp_css_allocate_stat_buffers(struct
atomisp_sub_device *asd,
dvs_grid_info);
if (!dis_buf->dis_data) {
dev_err(isp->dev, "dvs buf allocation failed.\n");
- if (s3a_buf)
+ if (s3a_buf) {
+ hmm_vunmap(s3a_buf->s3a_data->data_ptr);
+
ia_css_isp_3a_statistics_map_free(s3a_buf->s3a_map);
ia_css_isp_3a_statistics_free(s3a_buf->s3a_data);
+ }
return -EINVAL;
}
@@ -1132,10 +1135,16 @@ int atomisp_css_allocate_stat_buffers(struct
atomisp_sub_device *asd,
md_buf->metadata = ia_css_metadata_allocate(
&asd->stream_env[stream_id].stream_info.metadata_info);
if (!md_buf->metadata) {
- if (s3a_buf)
+ if (s3a_buf) {
+ hmm_vunmap(s3a_buf->s3a_data->data_ptr);
+
ia_css_isp_3a_statistics_map_free(s3a_buf->s3a_map);
ia_css_isp_3a_statistics_free(s3a_buf->s3a_data);
- if (dis_buf)
+ }
+ if (dis_buf) {
+ hmm_vunmap(dis_buf->dis_data->data_ptr);
+
ia_css_isp_dvs_statistics_map_free(dis_buf->dvs_map);
ia_css_isp_dvs2_statistics_free(dis_buf->dis_data);
+ }
dev_err(isp->dev, "metadata buf allocation failed.\n");
return -EINVAL;
}
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
