[PATCH] media: renesas: ceu: free device data if video device is unregistered

[Guangshuo Li <lgs201920130244@gmail.com>]

ceu_probe() allocates ceudev, while ceu_remove() does not free it if the
video device has not been registered.

The video device is registered from the async notifier complete
callback, and its release callback is responsible for freeing ceudev.
If the device is removed before the notifier completes, or before video
device registration succeeds, video_unregister_device() does not invoke
the release callback and the ceudev allocation is leaked.

Check whether the video device was registered during remove. Unregister
it normally when registered so that its release callback handles the
final free, otherwise free ceudev directly.

This issue was found by manual code inspection.

Fixes: 32e5a70dc8f4 ("media: platform: Add Renesas CEU driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/media/platform/renesas/renesas-ceu.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/renesas/renesas-ceu.c b/drivers/media/platform/renesas/renesas-ceu.c
index 65f7659a9e02..5015b7837381 100644
--- a/drivers/media/platform/renesas/renesas-ceu.c
+++ b/drivers/media/platform/renesas/renesas-ceu.c
@@ -1705,7 +1705,10 @@ static void ceu_remove(struct platform_device *pdev)
 
 	v4l2_device_unregister(&ceudev->v4l2_dev);
 
-	video_unregister_device(&ceudev->vdev);
+	if (video_is_registered(&ceudev->vdev))
+		video_unregister_device(&ceudev->vdev);
+	else
+		kfree(ceudev);
 }
 
 static const struct dev_pm_ops ceu_pm_ops = {
-- 
2.43.0