media: platform: mtk-mdp3: fix device leaks at probe

commit 8f6f3aa21517ef34d50808af0c572e69580dca20 upstream.

Make sure to drop the references taken when looking up the subsys
devices during probe on probe failure (e.g. probe deferral) and on
driver unbind.

Similarly, drop the SCP device reference after retrieving its platform
data during probe to avoid leaking it.

Note that holding a reference to a device does not prevent its driver
data from going away.

Fixes: 61890ccaefaf ("media: platform: mtk-mdp3: add MediaTek MDP3 driver")
Cc: stable@vger.kernel.org	# 6.1
Cc: Moudy Ho <moudy.ho@mediatek.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c
index 37e7b985d52ccad80c381fd04826949d1a86cf58..afa47649dd4c60d29da27e528d4ac14a14ee9341 100644 (file)
--- a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c
+++ b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c
@@ -176,10 +176,18 @@ void mdp_video_device_release(struct video_device *vdev)
        kfree(mdp);
 }
 
+static void mdp_put_device(void *_dev)
+{
+       struct device *dev = _dev;
+
+       put_device(dev);
+}
+
 static int mdp_mm_subsys_deploy(struct mdp_dev *mdp, enum mdp_infra_id id)
 {
        struct platform_device *mm_pdev = NULL;
        struct device **dev;
+       int ret;
        int i;
 
        if (!mdp)
@@ -213,6 +221,11 @@ static int mdp_mm_subsys_deploy(struct mdp_dev *mdp, enum mdp_infra_id id)
                if (WARN_ON(!mm_pdev))
                        return -ENODEV;
 
+               ret = devm_add_action_or_reset(&mdp->pdev->dev, mdp_put_device,
+                                              &mm_pdev->dev);
+               if (ret)
+                       return ret;
+
                *dev = &mm_pdev->dev;
        }
 
@@ -298,6 +311,7 @@ static int mdp_probe(struct platform_device *pdev)
                        goto err_destroy_clock_wq;
                }
                mdp->scp = platform_get_drvdata(mm_pdev);
+               put_device(&mm_pdev->dev);
        }
 
        mdp->rproc_handle = scp_get_rproc(mdp->scp);