From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F2B5A37755C for ; Mon, 27 Jul 2026 10:49:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.53 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785149380; cv=none; b=ZqPmcjaoe0/CYf3ebQmKUiLTgQ9NMBkz4qW05RBniJBRzKgnFM8l7buKIv32wb225CxUqRHTwRwP5In6ctVWOBlfoCbA5qbVgo1XCyy8S5q+RAiCK5FZW0Vhl+2gu68Tpv0lWpO4g+pWldExrxUUkjWJrmwkqxXBDOD6X3z+DXE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785149380; c=relaxed/simple; bh=jStPYMXmFPqwTl0vq7UVe0m+/5Eqz8DD2z/KI52ZQo0=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=TFdKr2Uy62GQpAhJJBZ6jqSNuReMvkIF05+tpS5UJsvAJCQPWm+bxFUau2YBL0jfzULjlFVyeWInuOUww9jHFPybUFaIwndyUN32Jy0R+d/oQZK3AmxtIWg8BGA0IoaX3qLq02tIFZ0H1MEkmjCzPoHnU3eM+1x9EnuLfWU39lM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ngHNFA3D; arc=none smtp.client-ip=209.85.216.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ngHNFA3D" Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-38a0c7e841fso2894000a91.2 for ; Mon, 27 Jul 2026 03:49:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785149378; x=1785754178; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=duRNht6et+Fl8R8XCxDZOkDs1DxWvcJnqfifU+vvHvo=; b=ngHNFA3Dlde19NpT3KzwyCeQgkM79XEj2IjLfnbeKdmjwWDB/TNfXbt7kHQISoIrU0 6MCRoUTtwu+6m8zUb4GU55+K3BnOwGH+6OHTqjvaqAKtgN5d/xySaWe63Ctb5iR6cqGh 4OLDHVPrwKMPx6B0aZFw9LRQ2MS8dIII159t2zpJlkKhdtUAAndWQhbtfaH2jOTsytl2 K5EAsJPKgoA02FWJ7hnqyzC22NYk5vozNiDGHLzS7DPHEzUWZAWknO3jq9bIzzl//VFr LwYzJUcxGgNkDV+7jMx6TSxnJhP1hZtliKMttIKEKGnIOezS5NDgXCD4sC3nckyDsudI 5qBA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785149378; x=1785754178; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=duRNht6et+Fl8R8XCxDZOkDs1DxWvcJnqfifU+vvHvo=; b=T0hBjjn9wkFhpqEIGVCkuZJEzXOj8tYEjgjbBven5zdzR0BfJs6wmphXGnIkSHaKWf SnrU17RaPGuEXC71lfAjzfxSNrtP9U9ln/acpUcvMOG54DC6VLbpD+rUpRKrhZ3Zkz8J kNapNIwmixunhz9t6Qkh2CJxxL3OB6oq9QekLIzyUVquFd6Arr4PbA2oMN03gKAELNsY Z7n3Zj/HTrpXwV0YNPAtGr/PN3EZOI6eF1wCaYCh7MCX3pveW4UpFN78vbz7zgBkr6RW HcXL8xhr18g+t7V/CN/NfjgUfM+amZ/5mnVV0+a4bP+LuBpSETonTsE3QfoVvWc5II9y sfDg== X-Forwarded-Encrypted: i=1; AHgh+RpHkg52mblO/GQen9+Ko8oLsak9MkNpre+btqgReVBdT3btIjCqzEwar43k7nmjpu7lkNjRM1jWxiqWp18=@vger.kernel.org X-Gm-Message-State: AOJu0YwWx4HjOdy0kJJpfsPPIygHI5rx9iBXm2ps3xBV9RfGun1bTS7n PeaCUiIcU9a5PdcFF0A5pevlHnXcWPGM98jhioHLaHFZs096VGgMJoCx X-Gm-Gg: AR+sD10M5hfUMv/R8ctNu3umZO/42J8REhnF2N4KZ6j/k5fn9L2Z1VbDtg5u9JtFIQv +GbFcceeBK57dv0+HkQLPASB03ZqcTuwRIAsjsNnq1qGtdlMc+rddn5mpv4z4PL55CnGOn+qflp 2VBtOUIYv4ks3TqrJJt6Sjwg62yOBk7wOZu1ojDQHuuJEoOKSocVKuWJwksh92JrRnCt5axPWoY r0Up7eOm5QhKn2dFI/jsX0up2d3sgFxwg+/tGhbrSKQx2V2Euxcx5RSivX4ftlzkK+q4vsPaRzs zuq5SDYtbg/JEZVMGsk18eorroFwAVv0HdRYvgU3LZCcwVONstiPJ/EcvmaYVLUb1jFEQPbAck5 UWW5oskt5JH9zVgXC2yynbR2pLfYm556NviyfqZjlW7v2KRQ0R15QrEfb+YTMqb/UmRj3e2WIvi DeJy2hKWnQQqWIrmYfFi0= X-Received: by 2002:a17:90b:554d:b0:38e:4f41:83df with SMTP id 98e67ed59e1d1-38f294ea1e4mr7649628a91.15.1785149378420; Mon, 27 Jul 2026 03:49:38 -0700 (PDT) Received: from SGN-LDSENG.tasernet.com ([2405:4800:5cc3:11a:1ac0:4dff:fe8b:4a69]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-314bc548e63sm31716481eec.19.2026.07.27.03.49.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Jul 2026 03:49:38 -0700 (PDT) From: Cong Nguyen To: Steve Longerbeam , Philipp Zabel , Mauro Carvalho Chehab , Greg Kroah-Hartman Cc: Frank Li , Hans Verkuil , linux-media@vger.kernel.org, imx@lists.linux.dev, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, Cong Nguyen Subject: [PATCH] staging: media: imx: csc-scaler: fix ipu_image_convert_run leak on queue error Date: Mon, 27 Jul 2026 17:49:27 +0700 Message-Id: <20260727104927.520546-1-congnt264@gmail.com> X-Mailer: git-send-email 2.25.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit device_run() allocates an ipu_image_convert_run object and, on the success path, hands it to the IPU image conversion core via ipu_image_convert_queue(); the run object is then freed asynchronously by the completion callback ipu_ic_pp_complete(). However, if ipu_image_convert_queue() fails, the core never takes ownership of the run object and the completion callback is never invoked. The "err" label finishes the mem2mem job and reports the buffers as errored, but never frees the run object that was just allocated, leaking it on every queue failure. Free the run object in the error path. There is no risk of a double free: the completion callback only runs after the object was successfully queued, which is mutually exclusive with reaching the error path. It is also safe for the earlier "goto err" on allocation failure, since run is NULL there and kfree(NULL) is a no-op. Fixes: a8ef0488cc59 ("media: imx: add csc/scaler mem2mem device") Signed-off-by: Cong Nguyen --- drivers/staging/media/imx/imx-media-csc-scaler.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/staging/media/imx/imx-media-csc-scaler.c b/drivers/staging/media/imx/imx-media-csc-scaler.c index 00fcdd4d0487..359d973d297f 100644 --- a/drivers/staging/media/imx/imx-media-csc-scaler.c +++ b/drivers/staging/media/imx/imx-media-csc-scaler.c @@ -147,6 +147,7 @@ static void device_run(void *_ctx) v4l2_m2m_buf_done(src_buf, VB2_BUF_STATE_ERROR); v4l2_m2m_buf_done(dst_buf, VB2_BUF_STATE_ERROR); v4l2_m2m_job_finish(priv->m2m_dev, ctx->fh.m2m_ctx); + kfree(run); } /* -- 2.25.1