From 9c19a957d3bbe62fe2ea6dc2825a1770d5734133 Mon Sep 17 00:00:00 2001
From: Simon Glass <simon.glass@canonical.com>
Date: Sat, 3 Jan 2026 09:57:34 -0700
Subject: [PATCH] video: vidconsole: Free cursor save buffer on device removal

The cursor save_data buffer is allocated when the cursor is enabled but
never freed. Add a pre_remove callback to free this buffer when the
vidconsole device is removed.

Fixes: aebedeac4478 ("video: Provide a buffer to hold pixels behind the cursor")
Co-developed-by: Claude <noreply@anthropic.com>
Signed-off-by: Simon Glass <simon.glass@canonical.com>
---
 drivers/video/vidconsole-uclass.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/video/vidconsole-uclass.c b/drivers/video/vidconsole-uclass.c
index 52a51b5e1c1..8efe458287a 100644
--- a/drivers/video/vidconsole-uclass.c
+++ b/drivers/video/vidconsole-uclass.c
@@ -14,6 +14,7 @@
 #include <command.h>
 #include <console.h>
 #include <log.h>
+#include <malloc.h>
 #include <dm.h>
 #include <video.h>
 #include <video_console.h>
@@ -865,11 +866,21 @@ static int vidconsole_post_probe(struct udevice *dev)
 	return stdio_register(sdev);
 }
 
+static int vidconsole_pre_remove(struct udevice *dev)
+{
+	struct vidconsole_priv *vc_priv = dev_get_uclass_priv(dev);
+
+	free(vc_priv->curs.save_data);
+
+	return 0;
+}
+
 UCLASS_DRIVER(vidconsole) = {
 	.id		= UCLASS_VIDEO_CONSOLE,
 	.name		= "vidconsole0",
 	.pre_probe	= vidconsole_pre_probe,
 	.post_probe	= vidconsole_post_probe,
+	.pre_remove	= vidconsole_pre_remove,
 	.per_device_auto	= sizeof(struct vidconsole_priv),
 };