github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

media: platform: mtk-mdp3: Fix device reference leak in mdp_comp_init()

Browse Source 
mdp_comp_init() takes a reference to the component platform device
with of_find_device_by_node(), but the error path taken when the
clock array cannot be allocated and the one taken for a component
without a GCE EOF event return without dropping it.  The caller
frees the mdp_comp in those cases, so the reference is leaked.

Release the reference on both error paths.

Fixes: c4320f9721 ("media: platform: mtk-mdp3: dynamically allocate component clocks")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
This commit is contained in:
Wentao Liang 2026-09-17 10:07:21 +00:00 committed by Hans Verkuil
parent fed2e02a12
commit ff3308afa9
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c
View File

@ -1730,6 +1730,7 @@ static int mdp_comp_init(struct mdp_dev *mdp, struct device_node *node,
struct device *dev = &mdp->pdev->dev;
struct platform_device *pdev_c;
int clk_ofst;
int ret;
int i;
s32 event;
@ -1756,8 +1757,10 @@ static int mdp_comp_init(struct mdp_dev *mdp, struct device_node *node,
comp->clk_num = mdp->mdp_data->comp_data[id].info.clk_num;
comp->clks = devm_kzalloc(dev, sizeof(struct clk *) * comp->clk_num,
GFP_KERNEL);
if (!comp->clks)
return -ENOMEM;
if (!comp->clks) {
ret = -ENOMEM;
goto err_put_device;
}
clk_ofst = mdp->mdp_data->comp_data[id].info.clk_ofst;
@ -1782,7 +1785,8 @@ static int mdp_comp_init(struct mdp_dev *mdp, struct device_node *node,
if (of_property_read_u32_index(node, "mediatek,gce-events",
MDP_GCE_EVENT_EOF, &event)) {
dev_err(dev, "Component id %d has no EOF\n", id);
return -EINVAL;
ret = -EINVAL;
goto err_put_device;
}
} else {
event = MDP_GCE_NO_EVENT;
@ -1791,6 +1795,10 @@ static int mdp_comp_init(struct mdp_dev *mdp, struct device_node *node,
comp->gce_event[MDP_GCE_EVENT_EOF] = event;
return 0;
err_put_device:
put_device(&pdev_c->dev);
return ret;
}
static void mdp_comp_deinit(struct mdp_comp *comp)