psb_driver_load() initializes KMS polling before it attempts to initialize
backlight support. If gma_backlight_init() fails, the function returns
directly and skips psb_driver_unload(), leaving the resources allocated
earlier in probe, including KMS polling, active.

Simply using out_err is not safe: a failed backlight_device_register()
leaves an error pointer in backlight_device, which gma_backlight_exit()
would pass to backlight_device_unregister().

Move backlight cleanup to psb_device_release(), which is registered only
after successful backlight initialization, and use out_err on backlight
initialization failure. This unwinds the earlier resources without trying
to unregister a failed backlight device. Normal device release and failure
to register the managed release action retain the existing cleanup order.

This issue was identified during our ongoing static-analysis research while
reviewing kernel code.

Fixes: 1f90b1232773 ("drm/gma500: Refactor backlight support (v2)")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
Changes in v2:
- Move backlight cleanup to the managed release callback so the probe
  error path cannot unregister an ERR_PTR, addressing Patrik's feedback.

 drivers/gpu/drm/gma500/psb_drv.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c
index 005ab7f535..c4cc4bf5f4 100644
--- a/drivers/gpu/drm/gma500/psb_drv.c
+++ b/drivers/gpu/drm/gma500/psb_drv.c
@@ -170,7 +170,6 @@ static void psb_driver_unload(struct drm_device *dev)
 
 	/* TODO: Kill vblank etc here */
 
-	gma_backlight_exit(dev);
 	psb_modeset_cleanup(dev);
 
 	gma_irq_uninstall(dev);
@@ -227,6 +226,7 @@ static void psb_device_release(void *data)
 {
 	struct drm_device *dev = data;
 
+	gma_backlight_exit(dev);
 	psb_driver_unload(dev);
 }
 
@@ -406,7 +406,7 @@ static int psb_driver_load(struct drm_device *dev, unsigned long flags)
 	drm_connector_list_iter_end(&conn_iter);
 
 	if (ret)
-		return ret;
+		goto out_err;
 	psb_intel_opregion_enable_asle(dev);
 
 	return devm_add_action_or_reset(dev->dev, psb_device_release, dev);
-- 
2.47.1