vd56g3_subdev_init() calls v4l2_subdev_init_finalize(), which allocates
the subdev active state and requires v4l2_subdev_cleanup() to release it.
If vd56g3_update_controls() fails after finalize succeeds, the probe error
path currently skips v4l2_subdev_cleanup() and returns an error. The driver
.remove() callback is not called after a failed probe, so the active state
is leaked.
Route this error through a subdev cleanup label before freeing the control
handler and media entity.
Fixes: 87aa97fc3157 ("media: i2c: Add driver for ST VD56G3 camera sensor")
Cc: stable@vger.kernel.org
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
drivers/media/i2c/vd56g3.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/media/i2c/vd56g3.c b/drivers/media/i2c/vd56g3.c
index 157acea9e2..43f792288a 100644
--- a/drivers/media/i2c/vd56g3.c
+++ b/drivers/media/i2c/vd56g3.c
@@ -1427,11 +1427,14 @@ static int vd56g3_subdev_init(struct vd56g3 *sensor)
v4l2_subdev_unlock_state(state);
if (ret) {
dev_err(sensor->dev, "Controls update failed: %d\n", ret);
- goto err_ctrls;
+ goto err_subdev;
}
return 0;
+err_subdev:
+ v4l2_subdev_cleanup(&sensor->sd);
+
err_ctrls:
v4l2_ctrl_handler_free(sensor->sd.ctrl_handler);
--
2.50.1