From ff3308afa9c9da0ef9113cb80803588adabef902 Mon Sep 17 00:00:00 2001 From: Wentao Liang Date: Thu, 17 Sep 2026 10:07:21 +0000 Subject: [PATCH] media: platform: mtk-mdp3: Fix device reference leak in mdp_comp_init() mdp_comp_init() takes a reference to the component platform device with of_find_device_by_node(), but the error path taken when the clock array cannot be allocated and the one taken for a component without a GCE EOF event return without dropping it. The caller frees the mdp_comp in those cases, so the reference is leaked. Release the reference on both error paths. Fixes: c4320f9721fd ("media: platform: mtk-mdp3: dynamically allocate component clocks") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil --- .../media/platform/mediatek/mdp3/mtk-mdp3-comp.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c index 7fcb2fbdd64e..acb2758a7b42 100644 --- a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c +++ b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c @@ -1730,6 +1730,7 @@ static int mdp_comp_init(struct mdp_dev *mdp, struct device_node *node, struct device *dev = &mdp->pdev->dev; struct platform_device *pdev_c; int clk_ofst; + int ret; int i; s32 event; @@ -1756,8 +1757,10 @@ static int mdp_comp_init(struct mdp_dev *mdp, struct device_node *node, comp->clk_num = mdp->mdp_data->comp_data[id].info.clk_num; comp->clks = devm_kzalloc(dev, sizeof(struct clk *) * comp->clk_num, GFP_KERNEL); - if (!comp->clks) - return -ENOMEM; + if (!comp->clks) { + ret = -ENOMEM; + goto err_put_device; + } clk_ofst = mdp->mdp_data->comp_data[id].info.clk_ofst; @@ -1782,7 +1785,8 @@ static int mdp_comp_init(struct mdp_dev *mdp, struct device_node *node, if (of_property_read_u32_index(node, "mediatek,gce-events", MDP_GCE_EVENT_EOF, &event)) { dev_err(dev, "Component id %d has no EOF\n", id); - return -EINVAL; + ret = -EINVAL; + goto err_put_device; } } else { event = MDP_GCE_NO_EVENT; @@ -1791,6 +1795,10 @@ static int mdp_comp_init(struct mdp_dev *mdp, struct device_node *node, comp->gce_event[MDP_GCE_EVENT_EOF] = event; return 0; + +err_put_device: + put_device(&pdev_c->dev); + return ret; } static void mdp_comp_deinit(struct mdp_comp *comp)