media: mali-c55: Add missing of_reserved_mem_device_release()

mali_c55_probe() calls of_reserved_mem_device_init() to associate
reserved memory regions with the device. This function allocates a
struct rmem_assigned_device and adds it to a global linked list, which
must be explicitly released via of_reserved_mem_device_release() — there
is no devm variant of this API.

However, neither the probe error paths nor mali_c55_remove() called
of_reserved_mem_device_release(). Any probe failure after the
of_reserved_mem_device_init() call, as well as every normal device
removal, leaked the reserved memory association on the global list.

Fix this by adding an err_release_mem label at the end of the probe
error chain and calling of_reserved_mem_device_release() in
mali_c55_remove(). The remove teardown order is also corrected to call
mali_c55_media_frameworks_deinit() before kfree(), mirroring the probe
init order in reverse.

Cc: stable@vger.kernel.org
Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Signed-off-by: Jacopo Mondi <jacopo.mondi+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-core.c b/drivers/media/platform/arm/mali-c55/mali-c55-core.c
index 6505d3be98072698f093fcf25e4e87e150168788..305b8cbb9d1c357b7140b4b711e24664ade44d03 100644 (file)
--- a/drivers/media/platform/arm/mali-c55/mali-c55-core.c
+++ b/drivers/media/platform/arm/mali-c55/mali-c55-core.c
@@ -806,8 +806,10 @@ static int mali_c55_probe(struct platform_device *pdev)
        vb2_dma_contig_set_max_seg_size(dev, UINT_MAX);
 
        ret = __mali_c55_power_on(mali_c55);
-       if (ret)
-               return dev_err_probe(dev, ret, "failed to power on\n");
+       if (ret) {
+               dev_err_probe(dev, ret, "failed to power on\n");
+               goto err_release_mem;
+       }
 
        ret = mali_c55_check_hwcfg(mali_c55);
        if (ret)
@@ -845,6 +847,8 @@ err_free_context_registers:
        kfree(mali_c55->context.registers);
 err_power_off:
        __mali_c55_power_off(mali_c55);
+err_release_mem:
+       of_reserved_mem_device_release(dev);
 
        return ret;
 }
@@ -853,8 +857,9 @@ static void mali_c55_remove(struct platform_device *pdev)
 {
        struct mali_c55 *mali_c55 = platform_get_drvdata(pdev);
 
-       kfree(mali_c55->context.registers);
        mali_c55_media_frameworks_deinit(mali_c55);
+       kfree(mali_c55->context.registers);
+       of_reserved_mem_device_release(&pdev->dev);
 }
 
 static const struct of_device_id mali_c55_of_match[] = {