[lvc-project] [PATCH] media: atomisp: avoid memory leak in ia_css_pipe_create_cas_scaler_desc_single_output()

[Fedor Pchelkin]

On Tue, 02. Dec 15:02, Alexandra Diupina wrote:
> ia_css_pipe_create_cas_scaler_desc_single_output() may fail,
> so add cleanup by ia_css_pipe_destroy_cas_scaler_desc()
> rather than simply exiting the function.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2")
> Signed-off-by: Alexandra Diupina <dyupina99999 at gmail.com>
> ---
>  drivers/staging/media/atomisp/pci/sh_css.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/staging/media/atomisp/pci/sh_css.c b/drivers/staging/media/atomisp/pci/sh_css.c
> index 73bd87f43a8c..4b553209af56 100644
> --- a/drivers/staging/media/atomisp/pci/sh_css.c
> +++ b/drivers/staging/media/atomisp/pci/sh_css.c
> @@ -4528,7 +4528,7 @@ static int load_video_binaries(struct ia_css_pipe *pipe)
>  			  NULL,
>  			  &cas_scaler_descr);
>  		if (err)
> -			return err;
> +			goto ERR;
>  		mycs->num_yuv_scaler = cas_scaler_descr.num_stage;
>  		mycs->yuv_scaler_binary = kcalloc(cas_scaler_descr.num_stage,
>  						  sizeof(struct ia_css_binary),
> @@ -4561,7 +4561,10 @@ static int load_video_binaries(struct ia_css_pipe *pipe)
>  				return err;
>  			}
>  		}

Вот здесь в промежутке есть error-пути, которые тоже стоит обработать.

> +ERR:
>  		ia_css_pipe_destroy_cas_scaler_desc(&cas_scaler_descr);
> +		if (err)
> +			return err;
>  	}
>  
>  	{
> @@ -5107,7 +5110,7 @@ static int load_primary_binaries(
>  			  &cas_scaler_descr);
>  		if (err) {
>  			IA_CSS_LEAVE_ERR_PRIVATE(err);
> -			return err;
> +			goto ERR;
>  		}
>  		mycs->num_yuv_scaler = cas_scaler_descr.num_stage;
>  		mycs->yuv_scaler_binary = kcalloc(cas_scaler_descr.num_stage,
> @@ -5141,7 +5144,10 @@ static int load_primary_binaries(
>  				return err;
>  			}
>  		}

Здесь тоже.  Вон даже return err торчит на пару строк выше.

> +ERR:
>  		ia_css_pipe_destroy_cas_scaler_desc(&cas_scaler_descr);
> +		if (err)
> +			return err;
>  
>  	} else {
>  		capt_pp_out_info = pipe->output_info[0];
> -- 
> 2.30.2