If vpif_probe() fails on vpif_probe_complete(), then memory allocated at initialize_vpif() for global vpif_obj.dev[i] become unreleased.
The patch adds deallocation of vpif_obj.dev[i] on the error path. Signed-off-by: Young Xiao <[email protected]> --- drivers/media/platform/davinci/vpif_capture.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/drivers/media/platform/davinci/vpif_capture.c b/drivers/media/platform/davinci/vpif_capture.c index b5aacb0..63e6ec4 100644 --- a/drivers/media/platform/davinci/vpif_capture.c +++ b/drivers/media/platform/davinci/vpif_capture.c @@ -1621,6 +1621,14 @@ vpif_capture_get_pdata(struct platform_device *pdev) return NULL; } +static void free_vpif_objs(void) +{ + int i; + + for (i = 0; i < VPIF_DISPLAY_MAX_DEVICES; i++) + kfree(vpif_obj.dev[i]); +} + /** * vpif_probe : This function probes the vpif capture driver * @pdev: platform device pointer @@ -1701,7 +1709,10 @@ static __init int vpif_probe(struct platform_device *pdev) "registered sub device %s\n", subdevdata->name); } - vpif_probe_complete(); + err = vpif_probe_complete(); + if (err) { + goto probe_subdev_out; + } } else { vpif_obj.notifier.ops = &vpif_async_ops; err = v4l2_async_notifier_register(&vpif_obj.v4l2_dev, @@ -1722,6 +1733,7 @@ static __init int vpif_probe(struct platform_device *pdev) v4l2_device_unregister(&vpif_obj.v4l2_dev); cleanup: v4l2_async_notifier_cleanup(&vpif_obj.notifier); + free_vpif_objs(); return err; } @@ -1748,8 +1760,8 @@ static int vpif_remove(struct platform_device *device) ch = vpif_obj.dev[i]; /* Unregister video device */ video_unregister_device(&ch->video_dev); - kfree(vpif_obj.dev[i]); } + free_vpif_objs() return 0; } -- 2.7.4
