media: mtk-mdp: Fix a reference leak in mtk_mdp_probe()

[PATCH] media: mtk-mdp: Fix a reference leak in mtk_mdp_probe()

Posted by Haoxiang Li 4 months, 3 weeks ago

vpu_get_plat_device() increases the reference count of the returned
platform device. Add platform_device_put() to prevent reference leak.

Fixes: ee18fc7b0b95 ("media: mtk-mdp: handle vpu_wdt_reg_handler() errors during probe")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
---
 drivers/media/platform/mediatek/mdp/mtk_mdp_core.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c b/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c
index 80fdc6ff57e0..6aedb6033010 100644
--- a/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c
+++ b/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c
@@ -198,7 +198,7 @@ static int mtk_mdp_probe(struct platform_device *pdev)
 				  VPU_RST_MDP);
 	if (ret) {
 		dev_err(&pdev->dev, "Failed to register reset handler\n");
-		goto err_m2m_register;
+		goto err_vpu_get_dev;
 	}
 
 	platform_set_drvdata(pdev, mdp);
@@ -206,7 +206,7 @@ static int mtk_mdp_probe(struct platform_device *pdev)
 	ret = vb2_dma_contig_set_max_seg_size(&pdev->dev, DMA_BIT_MASK(32));
 	if (ret) {
 		dev_err(&pdev->dev, "Failed to set vb2 dma mag seg size\n");
-		goto err_m2m_register;
+		goto err_vpu_get_dev;
 	}
 
 	pm_runtime_enable(dev);
@@ -214,6 +214,9 @@ static int mtk_mdp_probe(struct platform_device *pdev)
 
 	return 0;
 
+err_vpu_get_dev:
+	platform_device_put(mdp->vpu_dev);
+
 err_m2m_register:
 	v4l2_device_unregister(&mdp->v4l2_dev);
 
-- 
2.25.1

Re: [PATCH] media: mtk-mdp: Fix a reference leak in mtk_mdp_probe()

Posted by Christophe JAILLET 4 months, 3 weeks ago

Le 15/09/2025 à 14:52, Haoxiang Li a écrit :
> vpu_get_plat_device() increases the reference count of the returned
> platform device. Add platform_device_put() to prevent reference leak.

Hi,

I think it is also missing in the remove function.

And while at it, mtk_mdp_unregister_m2m_device(mdp) seems to also be 
missing in the error handling path of the probe.

Just my 2c.

CJ

> 
> Fixes: ee18fc7b0b95 ("media: mtk-mdp: handle vpu_wdt_reg_handler() errors during probe")
> Cc: stable@vger.kernel.org
> Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
> ---
>   drivers/media/platform/mediatek/mdp/mtk_mdp_core.c | 7 +++++--
>   1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c b/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c
> index 80fdc6ff57e0..6aedb6033010 100644
> --- a/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c
> +++ b/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c
> @@ -198,7 +198,7 @@ static int mtk_mdp_probe(struct platform_device *pdev)
>   				  VPU_RST_MDP);
>   	if (ret) {
>   		dev_err(&pdev->dev, "Failed to register reset handler\n");
> -		goto err_m2m_register;
> +		goto err_vpu_get_dev;
>   	}
>   
>   	platform_set_drvdata(pdev, mdp);
> @@ -206,7 +206,7 @@ static int mtk_mdp_probe(struct platform_device *pdev)
>   	ret = vb2_dma_contig_set_max_seg_size(&pdev->dev, DMA_BIT_MASK(32));
>   	if (ret) {
>   		dev_err(&pdev->dev, "Failed to set vb2 dma mag seg size\n");
> -		goto err_m2m_register;
> +		goto err_vpu_get_dev;
>   	}
>   
>   	pm_runtime_enable(dev);
> @@ -214,6 +214,9 @@ static int mtk_mdp_probe(struct platform_device *pdev)
>   
>   	return 0;
>   
> +err_vpu_get_dev:
> +	platform_device_put(mdp->vpu_dev);
> +
>   err_m2m_register:
>   	v4l2_device_unregister(&mdp->v4l2_dev);
>