From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EF78D35E93A; Sat, 28 Feb 2026 17:41:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772300503; cv=none; b=H5jxjygz1Ej31ottlXL5PpUlbbxMtZyEaIgyc3czdv6bNLomzxng1B9cBjCQkeXskI9sCk98l5SYVHf+Sn8V1KMg27c4B9ud+Qv6ib+u7fvQIyqmWGA4viJ8Nq/o5qiX6d9Kk8FNRc+xSg/izMydHl/oOO3AjTfPBYFmq9QUMw4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772300503; c=relaxed/simple; bh=5if/RWMvFd/l30E/2EEFXgocpt+vp6WLqSuHhSUwgdI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Ojot0FsWHmW8SWGPy1COjfhE+GehPREYynv0nhkoT8M1xh2HoC5G/MTIxwHfMTtlEBJ+LYqHJ9ERBfXay4KNsdXRwKPiT5zsBP0R0SDiVseVWWG5lGB/iYVkBTh0JZowzgf8bU+y4wxMjzQck4tGnXAVdfLXhwCb+3iNpos07xw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=bBblxYb4; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="bBblxYb4" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CD70BC2BC87; Sat, 28 Feb 2026 17:41:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1772300502; bh=5if/RWMvFd/l30E/2EEFXgocpt+vp6WLqSuHhSUwgdI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bBblxYb4QqJmc19N/ya+cVKxNu24qUdT2vlYyu8x+Wq+cRWcKTGFoqdiULwADp6Sc QjXlRjabvYXkLbdHGeSpJ/0cx2zEinVhRb2IOXMe1u/dUKOssXqzU48j/ghfcRmp2o Je0w4lkLROkTzeI4GB2pMZTaiyGjUQ9tKiLHKSiPKgUWMt1KjbyJjM2URe0QU9JydT GjtC1YY48yb3ym4F6YJSTCS2pEJg92/RUSFrzqHfn68WZSM9wDg4lXocF08twTWaAp fVT/fcTfYT+U9W/56GYPN5eZnAXUe2TTC9qFE3Lq2w/LdHba7ZeorOzVsppBBWBwj4 j1EzjR8pqcrwg== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Haoxiang Li , Nicolas Dufresne , Hans Verkuil , Sasha Levin Subject: [PATCH 6.19 540/844] media: mtk-mdp: Fix error handling in probe function Date: Sat, 28 Feb 2026 12:27:33 -0500 Message-ID: <20260228173244.1509663-541-sashal@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20260228173244.1509663-1-sashal@kernel.org> References: <20260228173244.1509663-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit From: Haoxiang Li [ Upstream commit 8a8a3232abac5b972058a5f2cb3e33199d2a8648 ] Add mtk_mdp_unregister_m2m_device() on the error handling path to prevent resource leak. Add check for the return value of vpu_get_plat_device() to prevent null pointer dereference. And vpu_get_plat_device() increases the reference count of the returned platform device. Add platform_device_put() to prevent reference leak. Fixes: c8eb2d7e8202 ("[media] media: Add Mediatek MDP Driver") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil Signed-off-by: Sasha Levin --- .../media/platform/mediatek/mdp/mtk_mdp_core.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c b/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c index 80fdc6ff57e0e..f78fa30f18648 100644 --- a/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c +++ b/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c @@ -194,11 +194,17 @@ static int mtk_mdp_probe(struct platform_device *pdev) } mdp->vpu_dev = vpu_get_plat_device(pdev); + if (!mdp->vpu_dev) { + dev_err(&pdev->dev, "Failed to get vpu device\n"); + ret = -ENODEV; + goto err_vpu_get_dev; + } + ret = vpu_wdt_reg_handler(mdp->vpu_dev, mtk_mdp_reset_handler, mdp, VPU_RST_MDP); if (ret) { dev_err(&pdev->dev, "Failed to register reset handler\n"); - goto err_m2m_register; + goto err_reg_handler; } platform_set_drvdata(pdev, mdp); @@ -206,7 +212,7 @@ static int mtk_mdp_probe(struct platform_device *pdev) ret = vb2_dma_contig_set_max_seg_size(&pdev->dev, DMA_BIT_MASK(32)); if (ret) { dev_err(&pdev->dev, "Failed to set vb2 dma mag seg size\n"); - goto err_m2m_register; + goto err_reg_handler; } pm_runtime_enable(dev); @@ -214,6 +220,12 @@ static int mtk_mdp_probe(struct platform_device *pdev) return 0; +err_reg_handler: + platform_device_put(mdp->vpu_dev); + +err_vpu_get_dev: + mtk_mdp_unregister_m2m_device(mdp); + err_m2m_register: v4l2_device_unregister(&mdp->v4l2_dev); -- 2.51.0