From 8a6e017c06fbc1b96af618e82a4d35889d442964 Mon Sep 17 00:00:00 2001 From: Linmao Li Date: Tue, 4 Aug 2026 18:24:31 +0800 Subject: [PATCH] media: rcar-isp: Fix VSPX reference leaks of_parse_phandle() and of_find_device_by_node() both acquire references, but the ISPCORE probe never releases them. The device node reference is leaked immediately, and the VSPX device reference is leaked on probe failures and on driver removal. Drop the node reference once the platform device has been looked up, and release the device reference on the probe error paths and in the remove path. Signed-off-by: Linmao Li Reviewed-by: Jacopo Mondi Signed-off-by: Sakari Ailus --- drivers/media/platform/renesas/rcar-isp/core.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/drivers/media/platform/renesas/rcar-isp/core.c b/drivers/media/platform/renesas/rcar-isp/core.c index 181446ae5377..b5861d0cd0e8 100644 --- a/drivers/media/platform/renesas/rcar-isp/core.c +++ b/drivers/media/platform/renesas/rcar-isp/core.c @@ -820,6 +820,7 @@ static int risp_core_probe_resources(struct rcar_isp_core *core, return -ENODEV; vspx = of_find_device_by_node(of_vspx); + of_node_put(of_vspx); if (!vspx) return -ENODEV; @@ -828,7 +829,7 @@ static int risp_core_probe_resources(struct rcar_isp_core *core, ret = vsp1_isp_init(&vspx->dev); if (ret < 0) - return ret; + goto err_put_vspx; /* Attach to the RPP library * @@ -839,7 +840,7 @@ static int risp_core_probe_resources(struct rcar_isp_core *core, */ ret = clk_prepare_enable(core->clk); if (ret) - return ret; + goto err_put_vspx; usleep_range(2000, 4000); @@ -847,10 +848,16 @@ static int risp_core_probe_resources(struct rcar_isp_core *core, clk_disable_unprepare(core->clk); - if (!core->rpp) - return -ENODEV; + if (!core->rpp) { + ret = -ENODEV; + goto err_put_vspx; + } return 0; + +err_put_vspx: + put_device(&vspx->dev); + return ret; } int risp_core_probe(struct rcar_isp_core *core, struct platform_device *pdev, @@ -886,6 +893,7 @@ int risp_core_probe(struct rcar_isp_core *core, struct platform_device *pdev, v4l2_device_unregister(&core->v4l2_dev); err_destroy_rpp: rppx1_destroy(core->rpp); + put_device(core->vspx.dev); return ret; } @@ -904,4 +912,5 @@ void risp_core_remove(struct rcar_isp_core *core) mutex_destroy(&core->io_lock); rppx1_destroy(core->rpp); + put_device(core->vspx.dev); }