[media.git/next] media: i2c: ds90ub9x3: Fix extra fwnode_handle_put()

[media-ci]

On Fri Dec 6 10:26:37 2024 +0200, Tomi Valkeinen wrote:
> The ub913 and ub953 drivers call fwnode_handle_put(priv->sd.fwnode) as
> part of their remove process, and if the driver is removed multiple
> times, eventually leads to put "overflow", possibly causing memory
> corruption or crash.
> 
> The fwnode_handle_put() is a leftover from commit 905f88ccebb1 ("media:
> i2c: ds90ub9x3: Fix sub-device matching"), which changed the code
> related to the sd.fwnode, but missed removing these fwnode_handle_put()
> calls.
> 
> Cc: sta...@vger.kernel.org
> Fixes: 905f88ccebb1 ("media: i2c: ds90ub9x3: Fix sub-device matching")
> Reviewed-by: Jai Luthra <jai.lut...@ideasonboard.com>
> Signed-off-by: Tomi Valkeinen <tomi.valkei...@ideasonboard.com>
> Signed-off-by: Sakari Ailus <sakari.ai...@linux.intel.com>
> Signed-off-by: Mauro Carvalho Chehab <mchehab+hua...@kernel.org>

Patch committed.

Thanks,
Mauro Carvalho Chehab

 drivers/media/i2c/ds90ub913.c | 1 -
 drivers/media/i2c/ds90ub953.c | 1 -
 2 files changed, 2 deletions(-)

---

diff --git a/drivers/media/i2c/ds90ub913.c b/drivers/media/i2c/ds90ub913.c
index 8eed4a200fd8..b5375d736629 100644
--- a/drivers/media/i2c/ds90ub913.c
+++ b/drivers/media/i2c/ds90ub913.c
@@ -793,7 +793,6 @@ static void ub913_subdev_uninit(struct ub913_data *priv)
        v4l2_async_unregister_subdev(&priv->sd);
        ub913_v4l2_nf_unregister(priv);
        v4l2_subdev_cleanup(&priv->sd);
-       fwnode_handle_put(priv->sd.fwnode);
        media_entity_cleanup(&priv->sd.entity);
 }
 
diff --git a/drivers/media/i2c/ds90ub953.c b/drivers/media/i2c/ds90ub953.c
index 8b028a84f5bc..ba7bd8809d16 100644
--- a/drivers/media/i2c/ds90ub953.c
+++ b/drivers/media/i2c/ds90ub953.c
@@ -1288,7 +1288,6 @@ static void ub953_subdev_uninit(struct ub953_data *priv)
        v4l2_async_unregister_subdev(&priv->sd);
        ub953_v4l2_notifier_unregister(priv);
        v4l2_subdev_cleanup(&priv->sd);
-       fwnode_handle_put(priv->sd.fwnode);
        media_entity_cleanup(&priv->sd.entity);
 }