Bug 49991

Summary:	soc camera driver module may case memory leak
Product:	v4l-dvb	Reporter:	qingbin li (308123027)
Component:	v4l-other	Assignee:	v4l-other (v4l-dvb_v4l-other)
Status:	RESOLVED OBSOLETE
Severity:	high	CC:	alan
Priority:	P1
Hardware:	All
OS:	Linux
Kernel Version:	linux-2.6.x,linux-3.x.x	Subsystem:
Regression:	No	Bisected commit-id:

Description qingbin li 2012-11-03 12:15:45 UTC

why not call "videobuf_mmap_free",when device close call "soc_camera_close" in linux-2.6.x;do the same in linux-3.x.x?
video capture flow:
1)open
2)set fmt
3)request buffer-->__videobuf_mmap_setup-->videobuf_alloc_vb(q)
4)mmap
5)enqueue, dequeue
6)close--->soc_camera_close-->?should call:videobuf_mmap_free
NOTE:
I have reviewed all the code, found:soc_camera_driver device driver coders has no way(callback function) to call videobuf_mmap_free; it will case memory leak.

Comment 1 Alan 2012-11-05 14:12:54 UTC

Please take this discussion to the email list at linux-media@vger.kernel.org

Comment 2 Alan 2012-11-05 14:14:03 UTC

*** Bug 50031 has been marked as a duplicate of this bug. ***

Comment 3 qingbin li 2012-11-07 03:02:54 UTC

I'm sure it's a bug.In linux-2.6.x, we call open() will allocate a struct soc_camera_file which contains struct videobuf_queue;then usr will call request_buffer, soc_camera module will call videobuf_alloc_vb(q) which will be installed in q->bufs[i].
             My question is how to free q->bufs[i] which is allocated from vb = kzalloc(size + sizeof(*mem), GFP_KERNEL) if we use videobuf-dma-contig memory model? 
             videobuf_mmap_free()->kfree(q->bufs[i]) should call at every call close();we can't call kfree(q->bufs[i]) at q->ops->buf_release which is called in stream_off(), because q->bufs[i] reserve struct videobuf_mapping, unmap() will can't free videobuf which is used to store video data. Also can't call videobuf_mmap_free()->kfree(q->bufs[i]) at last close(), because in linux-2.6.x once open() allocates a videobuf_queue.
               In linux-3.x.x, we should call videobuf_mmap_free()->kfree(q->bufs[i]) only once at module remove callbcak function. 
              If is there no bug in soc camera module , i'm sure all device driver use soc camera module have bugs, such as sh_mobile_ceu_caera.c, mx1_caera.c, mx3_caera.c etc. all of them donn't call videobuf_mmap_free()->kfree(q->bufs[i]).