From: David Carlier Date: Sat, 28 Mar 2026 15:14:50 +0000 (+0000) Subject: media: mali-c55: Add missing of_reserved_mem_device_release() X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=38e3509dd98d7e970db87e13f8ec7412852a6967;p=thirdparty%2Fkernel%2Flinux.git media: mali-c55: Add missing of_reserved_mem_device_release() mali_c55_probe() calls of_reserved_mem_device_init() to associate reserved memory regions with the device. This function allocates a struct rmem_assigned_device and adds it to a global linked list, which must be explicitly released via of_reserved_mem_device_release() — there is no devm variant of this API. However, neither the probe error paths nor mali_c55_remove() called of_reserved_mem_device_release(). Any probe failure after the of_reserved_mem_device_init() call, as well as every normal device removal, leaked the reserved memory association on the global list. Fix this by adding an err_release_mem label at the end of the probe error chain and calling of_reserved_mem_device_release() in mali_c55_remove(). The remove teardown order is also corrected to call mali_c55_media_frameworks_deinit() before kfree(), mirroring the probe init order in reverse. Cc: stable@vger.kernel.org Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver") Signed-off-by: David Carlier Reviewed-by: Jacopo Mondi Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil --- diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-core.c b/drivers/media/platform/arm/mali-c55/mali-c55-core.c index 6505d3be9807..305b8cbb9d1c 100644 --- a/drivers/media/platform/arm/mali-c55/mali-c55-core.c +++ b/drivers/media/platform/arm/mali-c55/mali-c55-core.c @@ -806,8 +806,10 @@ static int mali_c55_probe(struct platform_device *pdev) vb2_dma_contig_set_max_seg_size(dev, UINT_MAX); ret = __mali_c55_power_on(mali_c55); - if (ret) - return dev_err_probe(dev, ret, "failed to power on\n"); + if (ret) { + dev_err_probe(dev, ret, "failed to power on\n"); + goto err_release_mem; + } ret = mali_c55_check_hwcfg(mali_c55); if (ret) @@ -845,6 +847,8 @@ err_free_context_registers: kfree(mali_c55->context.registers); err_power_off: __mali_c55_power_off(mali_c55); +err_release_mem: + of_reserved_mem_device_release(dev); return ret; } @@ -853,8 +857,9 @@ static void mali_c55_remove(struct platform_device *pdev) { struct mali_c55 *mali_c55 = platform_get_drvdata(pdev); - kfree(mali_c55->context.registers); mali_c55_media_frameworks_deinit(mali_c55); + kfree(mali_c55->context.registers); + of_reserved_mem_device_release(&pdev->dev); } static const struct of_device_id mali_c55_of_match[] = {