The davinci-vpif driver dereferences its local endpoints after releasing
the reference to them.

The driver also puts its endpoints explicitly while the
of_graph_get_next_endpoint() does that, too, leading to obtaining a
reference once and releasing it twice.

Both are fixed by this patch.

Signed-off-by: Sakari Ailus <sakari.ai...@linux.intel.com>
---
 drivers/media/platform/davinci/vpif_capture.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/media/platform/davinci/vpif_capture.c 
b/drivers/media/platform/davinci/vpif_capture.c
index f0f7ef638c56..394202c28b1a 100644
--- a/drivers/media/platform/davinci/vpif_capture.c
+++ b/drivers/media/platform/davinci/vpif_capture.c
@@ -1554,7 +1554,6 @@ vpif_capture_get_pdata(struct platform_device *pdev)
                if (!rem) {
                        dev_dbg(&pdev->dev, "Remote device at %pOF not found\n",
                                endpoint);
-                       of_node_put(endpoint);
                        goto done;
                }
 
@@ -1566,7 +1565,6 @@ vpif_capture_get_pdata(struct platform_device *pdev)
                                            GFP_KERNEL);
                if (!chan->inputs) {
                        of_node_put(rem);
-                       of_node_put(endpoint);
                        goto err_cleanup;
                }
 
@@ -1577,7 +1575,6 @@ vpif_capture_get_pdata(struct platform_device *pdev)
 
                err = v4l2_fwnode_endpoint_parse(of_fwnode_handle(endpoint),
                                                 &bus_cfg);
-               of_node_put(endpoint);
                if (err) {
                        dev_err(&pdev->dev, "Could not parse the endpoint\n");
                        of_node_put(rem);
@@ -1608,6 +1605,7 @@ vpif_capture_get_pdata(struct platform_device *pdev)
        }
 
 done:
+       of_node_put(endpoint);
        pdata->asd_sizes[0] = i;
        pdata->subdev_count = i;
        pdata->card_name = "DA850/OMAP-L138 Video Capture";
@@ -1615,6 +1613,7 @@ vpif_capture_get_pdata(struct platform_device *pdev)
        return pdata;
 
 err_cleanup:
+       of_node_put(endpoint);
        v4l2_async_notifier_cleanup(&vpif_obj.notifier);
 
        return NULL;
-- 
2.11.0

Reply via email to