On Fri Nov 14 09:12:57 2025 +0000, Zilin Guan wrote:
> The state object allocated by __v4l2_subdev_state_alloc() must be freed
> with __v4l2_subdev_state_free() when it is no longer needed.
>
> In __tegra_channel_try_format(), two error paths return directly after
> v4l2_subdev_call() fails, without freeing the allocated 'sd_state'
> object. This violates the requirement and causes a memory leak.
>
> Fix this by introducing a cleanup label and using goto statements in the
> error paths to ensure that __v4l2_subdev_state_free() is always called
> before the function returns.
>
> Fixes: 56f64b82356b7 ("media: tegra-video: Use zero crop settings if subdev
> has no get_selection")
> Fixes: 1ebaeb09830f3 ("media: tegra-video: Add support for external sensor
> capture")
> Cc: [email protected]
> Signed-off-by: Zilin Guan <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/staging/media/tegra-video/vi.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
---
diff --git a/drivers/staging/media/tegra-video/vi.c
b/drivers/staging/media/tegra-video/vi.c
index c9276ff76157..14b327afe045 100644
--- a/drivers/staging/media/tegra-video/vi.c
+++ b/drivers/staging/media/tegra-video/vi.c
@@ -438,7 +438,7 @@ static int __tegra_channel_try_format(struct
tegra_vi_channel *chan,
.target = V4L2_SEL_TGT_CROP_BOUNDS,
};
struct v4l2_rect *try_crop;
- int ret;
+ int ret = 0;
subdev = tegra_channel_get_remote_source_subdev(chan);
if (!subdev)
@@ -482,8 +482,10 @@ static int __tegra_channel_try_format(struct
tegra_vi_channel *chan,
} else {
ret = v4l2_subdev_call(subdev, pad, get_selection,
NULL, &sdsel);
- if (ret)
- return -EINVAL;
+ if (ret) {
+ ret = -EINVAL;
+ goto out_free;
+ }
try_crop->width = sdsel.r.width;
try_crop->height = sdsel.r.height;
@@ -495,14 +497,15 @@ static int __tegra_channel_try_format(struct
tegra_vi_channel *chan,
ret = v4l2_subdev_call(subdev, pad, set_fmt, sd_state, &fmt);
if (ret < 0)
- return ret;
+ goto out_free;
v4l2_fill_pix_format(pix, &fmt.format);
chan->vi->ops->vi_fmt_align(pix, fmtinfo->bpp);
+out_free:
__v4l2_subdev_state_free(sd_state);
- return 0;
+ return ret;
}
static int tegra_channel_try_format(struct file *file, void *fh,
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
