Subject: Re: [PATCH] media: nxp: imx8-isi: fix memory leaks in probe error paths and remove

From: Laurent Pinchart <[email-masked]>
Date: Mon, 30 Mar 2026 18:41:08 +0300

On Mon, Mar 30, 2026 at 10:46:43AM -0400, Frank Li wrote:
> On Fri, Mar 27, 2026 at 10:27:11PM +0000, David Carlier wrote:
> > mxc_isi_probe() allocates isi->pipes with kzalloc_objs() but never
> > frees it on any probe failure path or in mxc_isi_remove(), leaking the
> > allocation on every failed probe and every normal unbind.
> >
> > Additionally, when mxc_isi_pipe_init() fails partway through the
> > channel loop or when mxc_isi_v4l2_init() fails, the already initialized
> > pipes are not cleaned up — their media entities and mutexes are leaked.
> >
> > Fix both by adding kfree(isi->pipes) to all probe error paths and to
> > mxc_isi_remove(), and cleaning up already-initialized pipes in the
> > err_xbar error path.
> >
> > Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISP Channel driver")
> > Signed-off-by: David Carlier <[email-masked]>
> > ---
> 
> I think provide a helper function, devm_kzalloc_objs(), or using old
> devm_kzalloc is better fix method.

I quite agree. Kees said he's planning to introduce devm_kzalloc_objs().
I assume this will come in the next kernel version. I think we can wait
for that to fix this leak as it's a really minor issue.

> >  .../platform/nxp/imx8-isi/imx8-isi-core.c     | 24 +++++++++++++++----
> >  1 file changed, 19 insertions(+), 5 deletions(-)
> >
> > diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
> > index 4bf8570e1b9e..ab32c5b6ac9c 100644
> > --- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
> > +++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
> > @@ -490,33 +490,43 @@ static int mxc_isi_probe(struct platform_device *pdev)
> >  		return -ENOMEM;
> >
> >  	isi->num_clks = devm_clk_bulk_get_all(dev, &isi->clks);
> > -	if (isi->num_clks < 0)
> > +	if (isi->num_clks < 0) {
> > +		kfree(isi->pipes);
> >  		return dev_err_probe(dev, isi->num_clks, "Failed to get clocks\n");
> > +	}
> >
> >

-- 
Regards,

Laurent Pinchart