There are some error paths in atomisp_css_frame_allocate() which don't initialize "res" so it could lead us to try release random memory. Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> diff --git a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_cmd.c b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_cmd.c index d9a5c24633cb..0f01047cdf8e 100644 --- a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_cmd.c +++ b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_cmd.c @@ -4733,7 +4733,7 @@ static int atomisp_v4l2_framebuffer_to_css_frame(const struct v4l2_framebuffer *arg, struct atomisp_css_frame **result) { - struct atomisp_css_frame *res; + struct atomisp_css_frame *res = NULL; unsigned int padded_width; enum atomisp_css_frame_format sh_format; char *tmp_buf = NULL;