Re: [PATCH 1/2] media: rcar-isp: Fix VSPX reference leaks

[Jacopo Mondi <jacopo.mondi@ideasonboard.com>]

Hello Linmao Li

On Mon, Aug 03, 2026 at 05:05:52PM +0800, Linmao Li wrote:
> of_parse_phandle() and of_find_device_by_node() both acquire references,
> but the ISPCORE probe never releases them. The device node reference is
> leaked immediately, and the VSPX device reference is leaked on probe
> failures and on driver removal.
>
> Drop the node reference once the platform device has been looked up and
> release the device reference with a devm action.
>
> Fixes: 2151350f60d1 ("media: rcar-isp: Add support for ISPCORE")
> Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
> ---
>  drivers/media/platform/renesas/rcar-isp/core.c | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
>
> diff --git a/drivers/media/platform/renesas/rcar-isp/core.c b/drivers/media/platform/renesas/rcar-isp/core.c
> index f3dc52c136120..8dafffdd8de68 100644
> --- a/drivers/media/platform/renesas/rcar-isp/core.c
> +++ b/drivers/media/platform/renesas/rcar-isp/core.c
> @@ -781,6 +781,13 @@ int risp_core_registered(struct rcar_isp_core *core, struct v4l2_subdev *sd)
>  	return 0;
>  }
>
> +static void risp_core_put_device(void *data)
> +{
> +	struct device *dev = data;
> +
> +	put_device(dev);
> +}
> +
>  static int risp_core_probe_resources(struct rcar_isp_core *core,
>  				     struct platform_device *pdev)
>  {
> @@ -820,9 +827,15 @@ static int risp_core_probe_resources(struct rcar_isp_core *core,
>  		return -ENODEV;
>
>  	vspx = of_find_device_by_node(of_vspx);
> +	of_node_put(of_vspx);

I was about to suggest to declared of_vspx as:

	struct device_node *of_vspx = __free(device_node) = NULL;

But maybe it is not necessary since there's a single call place for
of_node_put().


>  	if (!vspx)
>  		return -ENODEV;
>
> +	ret = devm_add_action_or_reset(&pdev->dev, risp_core_put_device,
> +				       &vspx->dev);
> +	if (ret)
> +		return ret;
> +

For my education: what are the drawbacks of using
devm_add_action_or_reset() instead of releasing core->vspx on probe
failures and _remove() ?

Thanks
  j

>  	/* Attach to VSP-X */
>  	core->vspx.dev = &vspx->dev;
>
>
> base-commit: 31152f5b0f8719f92063b8c6196cd5e34106c73d
> --
> 2.25.1
>
>