msm: camera: common: Fixing memory leak issues and removing dead code

Fixed null pointer dereference, addressed memroy management issues and
removed unused variabels

CRs-Fixed: 3394193
Change-Id: I477d4b8ea781b20b5b2a66331bebb384e1c703c5
Signed-off-by: Atiya Kailany <quic_akailany@quicinc.com>

drivers/cam_sensor_module/cam_eeprom/cam_eeprom_core.c

@@ -601,6 +601,7 @@ static int32_t cam_eeprom_handle_continuous_write(
 	if (i2c_list == NULL ||
 		i2c_list->seq_settings.reg_data == NULL) {
 		CAM_ERR(CAM_SENSOR, "Failed in allocating i2c_list");
+		kfree(i2c_list);
 		return -ENOMEM;
 	}
 
@@ -643,6 +644,7 @@ static int32_t cam_eeprom_handle_continuous_write(
 	*list = &(i2c_list->list);
 	return rc;
 deallocate_i2c_list:
+	kfree(i2c_list->seq_settings.reg_data);
 	kfree(i2c_list);
 	return rc;
 }

drivers/cam_sensor_module/cam_flash/cam_flash_core.c

@@ -933,8 +933,6 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
 	int rc = 0, i = 0;
 	uintptr_t generic_ptr;
 	uint32_t total_cmd_buf_in_bytes = 0;
-	uint32_t processed_cmd_buf_in_bytes = 0;
-	uint16_t cmd_length_in_bytes = 0;
 	uint32_t *cmd_buf =  NULL;
 	uint32_t *offset = NULL;
 	uint32_t frm_offset = 0;
@@ -1012,7 +1010,6 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
 		/* Loop through multiple command buffers */
 		for (i = 1; i < csl_packet->num_cmd_buf; i++) {
 			total_cmd_buf_in_bytes = cmd_desc[i].length;
-			processed_cmd_buf_in_bytes = 0;
 			if (!total_cmd_buf_in_bytes)
 				continue;
 			rc = cam_mem_get_cpu_buf(cmd_desc[i].mem_handle,
@@ -1040,9 +1037,8 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
 
 			/* Loop through cmd formats in one cmd buffer */
 			CAM_DBG(CAM_FLASH,
-				"command Type: %d,Processed: %d,Total: %d",
-				cmn_hdr->cmd_type, processed_cmd_buf_in_bytes,
-				total_cmd_buf_in_bytes);
+				"command Type: %d,Total: %d",
+				cmn_hdr->cmd_type, total_cmd_buf_in_bytes);
 			switch (cmn_hdr->cmd_type) {
 			case CAMERA_SENSOR_FLASH_CMD_TYPE_INIT_INFO:
 				if (len_of_buffer <
@@ -1053,12 +1049,6 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
 
 				flash_init = (struct cam_flash_init *)cmd_buf;
 				fctrl->flash_type = flash_init->flash_type;
-				cmd_length_in_bytes =
-					sizeof(struct cam_flash_init);
-				processed_cmd_buf_in_bytes +=
-					cmd_length_in_bytes;
-				cmd_buf += cmd_length_in_bytes/
-						sizeof(uint32_t);
 				break;
 			case CAMERA_SENSOR_CMD_TYPE_I2C_INFO:
 				rc = cam_flash_slaveInfo_pkt_parser(
@@ -1069,27 +1059,15 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
 					rc);
 					return rc;
 				}
-				cmd_length_in_bytes =
-					sizeof(struct cam_cmd_i2c_info);
-				processed_cmd_buf_in_bytes +=
-					cmd_length_in_bytes;
-				cmd_buf += cmd_length_in_bytes/
-						sizeof(uint32_t);
 				break;
 			case CAMERA_SENSOR_CMD_TYPE_PWR_UP:
 			case CAMERA_SENSOR_CMD_TYPE_PWR_DOWN:
 				CAM_DBG(CAM_FLASH,
 					"Received power settings");
-				cmd_length_in_bytes =
-					total_cmd_buf_in_bytes;
 				rc = cam_sensor_update_power_settings(
 					cmd_buf,
 					total_cmd_buf_in_bytes,
 					&fctrl->power_info, remain_len);
-				processed_cmd_buf_in_bytes +=
-					cmd_length_in_bytes;
-				cmd_buf += cmd_length_in_bytes/
-						sizeof(uint32_t);
 				if (rc) {
 					CAM_ERR(CAM_FLASH,
 					"Failed update power settings");
@@ -1113,13 +1091,6 @@ int cam_flash_i2c_pkt_parser(struct cam_flash_ctrl *fctrl, void *arg)
 					"pkt parsing failed: %d", rc);
 					return rc;
 				}
-				cmd_length_in_bytes =
-					cmd_desc[i].length;
-				processed_cmd_buf_in_bytes +=
-					cmd_length_in_bytes;
-				cmd_buf += cmd_length_in_bytes/
-						sizeof(uint32_t);
-
 				break;
 			}
 		}

drivers/cam_sensor_module/cam_flash/cam_flash_dev.c

@@ -641,7 +641,7 @@ static int cam_flash_i2c_component_bind(struct device *dev,
 			rc  = rc ? rc : -EINVAL;
 			CAM_ERR(CAM_FLASH, "get failed for regulator %s %d",
 				soc_info->rgltr_name[i], rc);
-			goto free_ctrl;
+			goto free_ctrl_cci_client;
 		}
 		CAM_DBG(CAM_FLASH, "get for regulator %s",
 			soc_info->rgltr_name[i]);
@@ -653,7 +653,7 @@ static int cam_flash_i2c_component_bind(struct device *dev,
 		if (!soc_info->gpio_data->cam_gpio_common_tbl_size) {
 			CAM_DBG(CAM_FLASH, "No GPIO found");
 			rc = -EINVAL;
-			goto free_ctrl;
+			goto free_ctrl_cci_client;
 		}
 
 		rc = cam_sensor_util_init_gpio_pin_tbl(soc_info,
@@ -661,13 +661,13 @@ static int cam_flash_i2c_component_bind(struct device *dev,
 		if ((rc < 0) || (!fctrl->power_info.gpio_num_info)) {
 			CAM_ERR(CAM_FLASH, "No/Error Flash GPIOs");
 			rc = -EINVAL;
-			goto free_ctrl;
+			goto free_ctrl_cci_client;
 		}
 	}
 
 	rc = cam_flash_init_subdev(fctrl);
 	if (rc)
-		goto free_ctrl;
+		goto free_ctrl_cci_client;
 
 	fctrl->i2c_data.per_frame =
 		kzalloc(sizeof(struct i2c_settings_array) *
@@ -704,6 +704,8 @@ static int cam_flash_i2c_component_bind(struct device *dev,
 
 unreg_subdev:
 	cam_unregister_subdev(&(fctrl->v4l2_dev_str));
+free_ctrl_cci_client:
+	kfree(fctrl->io_master_info.cci_client);
 free_ctrl:
 	kfree(fctrl);
 	fctrl = NULL;

drivers/cam_sensor_module/cam_sensor_io/cam_sensor_spi.c

@@ -421,11 +421,19 @@ static int32_t cam_spi_page_program(struct camera_io_master *client,
 	memcpy(tx + header_len, data, len);
 	CAM_DBG(CAM_SENSOR, "tx(%u): %02x %02x %02x %02x",
 		len, tx[0], tx[1], tx[2], tx[3]);
-	while ((rc = spi_write(spi, tx, len + header_len)) && retries) {
-		rc = cam_spi_wait(client, pg, addr_type);
-		msleep(client->spi_client->retry_delay);
-		retries--;
-	}
+	do {
+		rc = spi_write(spi, tx, len + header_len);
+		if (rc) {
+			if (retries == 0) {
+				break;
+			} else {
+				retries--;
+				cam_spi_wait(client, pg, addr_type);
+				msleep(client->spi_client->retry_delay);
+			}
+		}
+	} while (rc);
+
 	if (rc < 0) {
 		CAM_ERR(CAM_SENSOR, "failed %d", rc);
 		return rc;

drivers/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/kernel.h>
@@ -2470,7 +2470,6 @@ int cam_sensor_util_power_down(struct cam_sensor_power_ctrl_t *ctrl,
 			return -EINVAL;
 		}
 
-		ps = NULL;
 		CAM_DBG(CAM_SENSOR_UTIL, "seq_type %d",  pd->seq_type);
 		switch (pd->seq_type) {
 		case SENSOR_MCLK: