[PATCH v2 0/2] media: rcar-isp: Fix ISPCORE resource leaks

[PATCH v2 0/2] media: rcar-isp: Fix ISPCORE resource leaks

[Linmao Li]

This series fixes resource leaks in the recently added ISPCORE support.

The patch order is swapped compared to v1. The VSPX reference is now
released explicitly rather than through a devm action, and it belongs at
the end of the error chain introduced by the resource cleanup patch, so
that patch comes first.

Changes in v2:
- Swap the patch order so the VSPX cleanup extends the error chain added
  by the first patch.
- Release the VSPX reference explicitly on the probe error paths and in
  the remove path instead of using a devm action (Niklas).
- Drop the Fixes tags because the ISPCORE support has not reached a
  release yet (Jacopo).
- Collect Reviewed-by tags on patch 1.

Linmao Li (2):
  media: rcar-isp: Release ISPCORE resources
  media: rcar-isp: Fix VSPX reference leaks

 .../media/platform/renesas/rcar-isp/core.c    | 29 ++++++++++++++-----
 1 file changed, 22 insertions(+), 7 deletions(-)


base-commit: 31152f5b0f8719f92063b8c6196cd5e34106c73d
-- 
2.25.1

[PATCH v2 1/2] media: rcar-isp: Release ISPCORE resources

[Linmao Li]

v4l2_device_register() takes a reference to the parent device, but the
ISPCORE remove path never calls v4l2_device_unregister(). The reference
is therefore leaked whenever an ISPCORE is removed.

Probe failures after rppx1_create() also return without destroying the
RPPX1 object.

Unregister the V4L2 device and destroy the RPPX1 object on the
corresponding error paths, and unregister the V4L2 device during removal.
v4l2_device_unregister() also unregisters all attached subdevices, so it
replaces the narrower subdevice-only cleanup.

Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
---
 drivers/media/platform/renesas/rcar-isp/core.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/media/platform/renesas/rcar-isp/core.c b/drivers/media/platform/renesas/rcar-isp/core.c
index f3dc52c136120..181446ae53779 100644
--- a/drivers/media/platform/renesas/rcar-isp/core.c
+++ b/drivers/media/platform/renesas/rcar-isp/core.c
@@ -870,17 +870,23 @@ int risp_core_probe(struct rcar_isp_core *core, struct platform_device *pdev,
 
 	ret = v4l2_device_register(core->dev, &core->v4l2_dev);
 	if (ret)
-		return ret;
+		goto err_destroy_rpp;
 
 	ret = risp_core_create_subdev(core);
 	if (ret)
-		return ret;
+		goto err_unregister_v4l2;
 
 	mutex_init(&core->io_lock);
 	spin_lock_init(&core->lock);
 	INIT_LIST_HEAD(&core->risp_jobs);
 
 	return 0;
+
+err_unregister_v4l2:
+	v4l2_device_unregister(&core->v4l2_dev);
+err_destroy_rpp:
+	rppx1_destroy(core->rpp);
+	return ret;
 }
 
 void risp_core_remove(struct rcar_isp_core *core)
@@ -894,7 +900,7 @@ void risp_core_remove(struct rcar_isp_core *core)
 	for (unsigned int i = 0; i < RISP_CORE_NUM_PADS; i++)
 		risp_core_io_destroy(&core->io[i]);
 
-	v4l2_device_unregister_subdev(&core->subdev);
+	v4l2_device_unregister(&core->v4l2_dev);
 
 	mutex_destroy(&core->io_lock);
 	rppx1_destroy(core->rpp);
-- 
2.25.1

[PATCH v2 2/2] media: rcar-isp: Fix VSPX reference leaks

[Linmao Li]

of_parse_phandle() and of_find_device_by_node() both acquire references,
but the ISPCORE probe never releases them. The device node reference is
leaked immediately, and the VSPX device reference is leaked on probe
failures and on driver removal.

Drop the node reference once the platform device has been looked up, and
release the device reference on the probe error paths and in the remove
path.

Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
---
 drivers/media/platform/renesas/rcar-isp/core.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/media/platform/renesas/rcar-isp/core.c b/drivers/media/platform/renesas/rcar-isp/core.c
index 181446ae53779..b5861d0cd0e8b 100644
--- a/drivers/media/platform/renesas/rcar-isp/core.c
+++ b/drivers/media/platform/renesas/rcar-isp/core.c
@@ -820,6 +820,7 @@ static int risp_core_probe_resources(struct rcar_isp_core *core,
 		return -ENODEV;
 
 	vspx = of_find_device_by_node(of_vspx);
+	of_node_put(of_vspx);
 	if (!vspx)
 		return -ENODEV;
 
@@ -828,7 +829,7 @@ static int risp_core_probe_resources(struct rcar_isp_core *core,
 
 	ret = vsp1_isp_init(&vspx->dev);
 	if (ret < 0)
-		return ret;
+		goto err_put_vspx;
 
 	/* Attach to the RPP library
 	 *
@@ -839,7 +840,7 @@ static int risp_core_probe_resources(struct rcar_isp_core *core,
 	 */
 	ret = clk_prepare_enable(core->clk);
 	if (ret)
-		return ret;
+		goto err_put_vspx;
 
 	usleep_range(2000, 4000);
 
@@ -847,10 +848,16 @@ static int risp_core_probe_resources(struct rcar_isp_core *core,
 
 	clk_disable_unprepare(core->clk);
 
-	if (!core->rpp)
-		return -ENODEV;
+	if (!core->rpp) {
+		ret = -ENODEV;
+		goto err_put_vspx;
+	}
 
 	return 0;
+
+err_put_vspx:
+	put_device(&vspx->dev);
+	return ret;
 }
 
 int risp_core_probe(struct rcar_isp_core *core, struct platform_device *pdev,
@@ -886,6 +893,7 @@ int risp_core_probe(struct rcar_isp_core *core, struct platform_device *pdev,
 	v4l2_device_unregister(&core->v4l2_dev);
 err_destroy_rpp:
 	rppx1_destroy(core->rpp);
+	put_device(core->vspx.dev);
 	return ret;
 }
 
@@ -904,4 +912,5 @@ void risp_core_remove(struct rcar_isp_core *core)
 
 	mutex_destroy(&core->io_lock);
 	rppx1_destroy(core->rpp);
+	put_device(core->vspx.dev);
 }
-- 
2.25.1

Re: [PATCH v2 2/2] media: rcar-isp: Fix VSPX reference leaks

[Jacopo Mondi]

Hello Linmao Li

On Tue, Aug 04, 2026 at 06:24:31PM +0800, Linmao Li wrote:
> of_parse_phandle() and of_find_device_by_node() both acquire references,
> but the ISPCORE probe never releases them. The device node reference is
> leaked immediately, and the VSPX device reference is leaked on probe
> failures and on driver removal.
>
> Drop the node reference once the platform device has been looked up, and
> release the device reference on the probe error paths and in the remove
> path.
>
> Signed-off-by: Linmao Li <lilinmao@kylinos.cn>

Thanks, looks good to me!

Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>

Sakari, Hans, should we collect these two patches as fixes for 7.3 ?


> ---
>  drivers/media/platform/renesas/rcar-isp/core.c | 17 +++++++++++++----
>  1 file changed, 13 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/media/platform/renesas/rcar-isp/core.c b/drivers/media/platform/renesas/rcar-isp/core.c
> index 181446ae53779..b5861d0cd0e8b 100644
> --- a/drivers/media/platform/renesas/rcar-isp/core.c
> +++ b/drivers/media/platform/renesas/rcar-isp/core.c
> @@ -820,6 +820,7 @@ static int risp_core_probe_resources(struct rcar_isp_core *core,
>  		return -ENODEV;
>
>  	vspx = of_find_device_by_node(of_vspx);
> +	of_node_put(of_vspx);
>  	if (!vspx)
>  		return -ENODEV;
>
> @@ -828,7 +829,7 @@ static int risp_core_probe_resources(struct rcar_isp_core *core,
>
>  	ret = vsp1_isp_init(&vspx->dev);
>  	if (ret < 0)
> -		return ret;
> +		goto err_put_vspx;
>
>  	/* Attach to the RPP library
>  	 *
> @@ -839,7 +840,7 @@ static int risp_core_probe_resources(struct rcar_isp_core *core,
>  	 */
>  	ret = clk_prepare_enable(core->clk);
>  	if (ret)
> -		return ret;
> +		goto err_put_vspx;
>
>  	usleep_range(2000, 4000);
>
> @@ -847,10 +848,16 @@ static int risp_core_probe_resources(struct rcar_isp_core *core,
>
>  	clk_disable_unprepare(core->clk);
>
> -	if (!core->rpp)
> -		return -ENODEV;
> +	if (!core->rpp) {
> +		ret = -ENODEV;
> +		goto err_put_vspx;
> +	}
>
>  	return 0;
> +
> +err_put_vspx:
> +	put_device(&vspx->dev);
> +	return ret;
>  }
>
>  int risp_core_probe(struct rcar_isp_core *core, struct platform_device *pdev,
> @@ -886,6 +893,7 @@ int risp_core_probe(struct rcar_isp_core *core, struct platform_device *pdev,
>  	v4l2_device_unregister(&core->v4l2_dev);
>  err_destroy_rpp:
>  	rppx1_destroy(core->rpp);
> +	put_device(core->vspx.dev);
>  	return ret;
>  }
>
> @@ -904,4 +912,5 @@ void risp_core_remove(struct rcar_isp_core *core)
>
>  	mutex_destroy(&core->io_lock);
>  	rppx1_destroy(core->rpp);
> +	put_device(core->vspx.dev);
>  }
> --
> 2.25.1
>
>

Re: [PATCH v2 2/2] media: rcar-isp: Fix VSPX reference leaks

[Sakari Ailus]

Hi Jacopo,

On Thu, Aug 06, 2026 at 11:33:50AM +0200, Jacopo Mondi wrote:
> Hello Linmao Li
> 
> On Tue, Aug 04, 2026 at 06:24:31PM +0800, Linmao Li wrote:
> > of_parse_phandle() and of_find_device_by_node() both acquire references,
> > but the ISPCORE probe never releases them. The device node reference is
> > leaked immediately, and the VSPX device reference is leaked on probe
> > failures and on driver removal.
> >
> > Drop the node reference once the platform device has been looked up, and
> > release the device reference on the probe error paths and in the remove
> > path.
> >
> > Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
> 
> Thanks, looks good to me!
> 
> Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
> 
> Sakari, Hans, should we collect these two patches as fixes for 7.3 ?

I've picked these and pushed these for merging.

-- 
Sakari Ailus