fimc_lite_create_capture_subdev() initializes fimc->ctrl_handler and adds a control to it. If the control cannot be created, handler->error is set and the function returns after cleaning up the media entity only. The control handler still owns the memory allocated for its buckets and for any control created before the failure, and fimc_lite_probe() does not call fimc_lite_unregister_capture_subdev() on this error, so that memory is leaked. Free the control handler before returning the error. Fixes: 4af813108b88 ("[media] s5p-fimc: Add support for Exynos4x12 FIMC-LITE") Cc: stable@vger.kernel.org Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex Signed-off-by: Wentao Liang --- drivers/media/platform/samsung/exynos4-is/fimc-lite.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/platform/samsung/exynos4-is/fimc-lite.c b/drivers/media/platform/samsung/exynos4-is/fimc-lite.c index 90599c82fd35..103c542a85b0 100644 --- a/drivers/media/platform/samsung/exynos4-is/fimc-lite.c +++ b/drivers/media/platform/samsung/exynos4-is/fimc-lite.c @@ -1402,6 +1402,7 @@ static int fimc_lite_create_capture_subdev(struct fimc_lite *fimc) NULL); if (handler->error) { media_entity_cleanup(&sd->entity); + v4l2_ctrl_handler_free(handler); return handler->error; } -- 2.34.1