[PATCH] staging: media: imx: csc-scaler: fix ipu_image_convert_run leak on queue error

[PATCH] staging: media: imx: csc-scaler: fix ipu_image_convert_run leak on queue error

[Cong Nguyen]

device_run() allocates an ipu_image_convert_run object and, on the
success path, hands it to the IPU image conversion core via
ipu_image_convert_queue(); the run object is then freed asynchronously
by the completion callback ipu_ic_pp_complete().

However, if ipu_image_convert_queue() fails, the core never takes
ownership of the run object and the completion callback is never
invoked. The "err" label finishes the mem2mem job and reports the
buffers as errored, but never frees the run object that was just
allocated, leaking it on every queue failure.

Free the run object in the error path. There is no risk of a double
free: the completion callback only runs after the object was
successfully queued, which is mutually exclusive with reaching the
error path. It is also safe for the earlier "goto err" on allocation
failure, since run is NULL there and kfree(NULL) is a no-op.

Fixes: a8ef0488cc59 ("media: imx: add csc/scaler mem2mem device")
Signed-off-by: Cong Nguyen <congnt264@gmail.com>
---
 drivers/staging/media/imx/imx-media-csc-scaler.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/staging/media/imx/imx-media-csc-scaler.c b/drivers/staging/media/imx/imx-media-csc-scaler.c
index 00fcdd4d0487..359d973d297f 100644
--- a/drivers/staging/media/imx/imx-media-csc-scaler.c
+++ b/drivers/staging/media/imx/imx-media-csc-scaler.c
@@ -147,6 +147,7 @@ static void device_run(void *_ctx)
 	v4l2_m2m_buf_done(src_buf, VB2_BUF_STATE_ERROR);
 	v4l2_m2m_buf_done(dst_buf, VB2_BUF_STATE_ERROR);
 	v4l2_m2m_job_finish(priv->m2m_dev, ctx->fh.m2m_ctx);
+	kfree(run);
 }
 
 /*
-- 
2.25.1

Re: [PATCH] staging: media: imx: csc-scaler: fix ipu_image_convert_run leak on queue error

[Frank.Li]

From: Frank Li <Frank.Li@nxp.com>


On Mon, 27 Jul 2026 17:49:27 +0700, Cong Nguyen wrote:
> device_run() allocates an ipu_image_convert_run object and, on the
> success path, hands it to the IPU image conversion core via
> ipu_image_convert_queue(); the run object is then freed asynchronously
> by the completion callback ipu_ic_pp_complete().
> 
> However, if ipu_image_convert_queue() fails, the core never takes
> ownership of the run object and the completion callback is never
> invoked. The "err" label finishes the mem2mem job and reports the
> buffers as errored, but never frees the run object that was just
> allocated, leaking it on every queue failure.
> 
> [...]

Applied, thanks!

[1/1] staging: media: imx: csc-scaler: fix ipu_image_convert_run leak on queue error
      commit: 70b993467aff501363c7bff3dfc4d76d6a138102

Best regards,
-- 
Frank Li <Frank.Li@nxp.com>