On Thu Apr 16 00:20:58 2026 +0800, Guangshuo Li wrote:
> When platform_device_register() fails in vivid_init(), the embedded
> struct device in vivid_pdev has already been initialized by
> device_initialize(), but the failure path jumps to free_output_strings
> without dropping the device reference for the current platform device:
>
> vivid_init()
> -> platform_device_register(&vivid_pdev)
> -> device_initialize(&vivid_pdev.dev)
> -> setup_pdev_dma_masks(&vivid_pdev)
> -> platform_device_add(&vivid_pdev)
>
> This leads to a reference leak when platform_device_register() fails.
> Fix this by calling platform_device_put() before jumping to the common
> cleanup path.
>
> Also, the unreg_driver label incorrectly calls
> platform_driver_register() instead of platform_driver_unregister(),
> which breaks cleanup when workqueue creation fails after successful
> driver registration. Fix that as well.
>
> The reference leak was identified by a static analysis tool I developed
> and confirmed by manual review. The incorrect cleanup call was found
> during code inspection.
>
> Fixes: f46d740fb0258 ("[media] vivid: turn this into a platform_device")
> Fixes: d7c969f37515d ("media: vivid: Add 'Is Connected To' menu controls")
> Cc: [email protected]
> Signed-off-by: Guangshuo Li <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/test-drivers/vivid/vivid-core.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
---
diff --git a/drivers/media/test-drivers/vivid/vivid-core.c
b/drivers/media/test-drivers/vivid/vivid-core.c
index c8bf9b4d406c..62cfb5feb2cf 100644
--- a/drivers/media/test-drivers/vivid/vivid-core.c
+++ b/drivers/media/test-drivers/vivid/vivid-core.c
@@ -2289,8 +2289,10 @@ static int __init vivid_init(void)
}
}
ret = platform_device_register(&vivid_pdev);
- if (ret)
+ if (ret) {
+ platform_device_put(&vivid_pdev);
goto free_output_strings;
+ }
ret = platform_driver_register(&vivid_pdrv);
if (ret)
goto unreg_device;
@@ -2311,7 +2313,7 @@ static int __init vivid_init(void)
destroy_hdmi_wq:
destroy_workqueue(update_hdmi_ctrls_workqueue);
unreg_driver:
- platform_driver_register(&vivid_pdrv);
+ platform_driver_unregister(&vivid_pdrv);
unreg_device:
platform_device_unregister(&vivid_pdev);
free_output_strings:
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
