samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

msm: camera: icp: Avoid resource leak during comp bind failure

Browse Source 
During ICP component bind, if any failure occurs, the icp_dev
struct is not freed. This change addresses that scenario.

CRs-Fixed: 3750367
Change-Id: Iee00b154bd209441b72ce8498999d85e6b940793
Signed-off-by: Nirmal Abraham <quic_c_nabrah@quicinc.com>
This commit is contained in:
Nirmal Abraham
2024-03-05 11:07:34 +05:30
parent 8a6c3c4c6e
commit 3b0ec887c5
1 changed files with 15 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
drivers/cam_icp/cam_icp_subdev.c
View File

@@ -1,7 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only // SPDX-License-Identifier: GPL-2.0-only
/* /*
* Copyright (c) 2017-2021, The Linux Foundation. All rights reserved. * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
* Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. * Copyright (c) 2022,2024 Qualcomm Innovation Center, Inc. All rights reserved.
*/ */
#include <linux/delay.h> #include <linux/delay.h>
@@ -251,11 +251,8 @@ const struct v4l2_subdev_internal_ops cam_icp_subdev_internal_ops = {
static inline int cam_icp_subdev_clean_up(uint32_t device_idx) static inline int cam_icp_subdev_clean_up(uint32_t device_idx)
{ {
struct cam_icp_subdev *icp_subdev; kfree(g_icp_dev[device_idx]);
g_icp_dev[device_idx] = NULL;
icp_subdev = g_icp_dev[device_idx];
icp_subdev->node = NULL;
icp_subdev->open_cnt = 0;
return 0; return 0;
} }
@@ -297,13 +294,6 @@ static int cam_icp_component_bind(struct device *dev,
else else
subdev_name = cam_icp_subdev_name_arr[device_idx]; subdev_name = cam_icp_subdev_name_arr[device_idx];
icp_dev = kzalloc(sizeof(struct cam_icp_subdev), GFP_KERNEL);
if (!icp_dev) {
CAM_ERR(CAM_ICP,
"Unable to allocate memory for icp device:%s size:%llu",
pdev->name, sizeof(struct cam_icp_subdev));
return -ENOMEM;
}
mutex_lock(&g_dev_lock); mutex_lock(&g_dev_lock);
if (g_icp_dev[device_idx]) { if (g_icp_dev[device_idx]) {
@@ -314,6 +304,17 @@ static int cam_icp_component_bind(struct device *dev,
mutex_unlock(&g_dev_lock); mutex_unlock(&g_dev_lock);
goto probe_fail; goto probe_fail;
} }
mutex_unlock(&g_dev_lock);
icp_dev = kzalloc(sizeof(struct cam_icp_subdev), GFP_KERNEL);
if (!icp_dev) {
CAM_ERR(CAM_ICP,
"Unable to allocate memory for icp device:%s size:%llu",
pdev->name, sizeof(struct cam_icp_subdev));
return -ENOMEM;
}
mutex_lock(&g_dev_lock);
g_icp_dev[device_idx] = icp_dev; g_icp_dev[device_idx] = icp_dev;
mutex_unlock(&g_dev_lock); mutex_unlock(&g_dev_lock);
@@ -373,6 +374,7 @@ ctx_fail:
cam_icp_context_deinit(&icp_dev->ctx_icp[i]); cam_icp_context_deinit(&icp_dev->ctx_icp[i]);
cam_icp_hw_mgr_deinit(device_idx); cam_icp_hw_mgr_deinit(device_idx);
hw_init_fail: hw_init_fail:
cam_node_deinit(icp_dev->node);
cam_subdev_remove(&icp_dev->sd); cam_subdev_remove(&icp_dev->sd);
probe_fail: probe_fail:
cam_icp_subdev_clean_up(device_idx); cam_icp_subdev_clean_up(device_idx);