On Tue Aug 4 18:24:30 2026 +0800, Linmao Li wrote:
> v4l2_device_register() takes a reference to the parent device, but the
> ISPCORE remove path never calls v4l2_device_unregister(). The reference
> is therefore leaked whenever an ISPCORE is removed.
>
> Probe failures after rppx1_create() also return without destroying the
> RPPX1 object.
>
> Unregister the V4L2 device and destroy the RPPX1 object on the
> corresponding error paths, and unregister the V4L2 device during removal.
> v4l2_device_unregister() also unregisters all attached subdevices, so it
> replaces the narrower subdevice-only cleanup.
>
> Signed-off-by: Linmao Li <[email protected]>
> Reviewed-by: Jacopo Mondi <[email protected]>
> Reviewed-by: Niklas Söderlund <[email protected]>
> Signed-off-by: Sakari Ailus <[email protected]>
Patch committed.
Thanks,
Sakari Ailus
drivers/media/platform/renesas/rcar-isp/core.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
---
diff --git a/drivers/media/platform/renesas/rcar-isp/core.c
b/drivers/media/platform/renesas/rcar-isp/core.c
index f3dc52c13612..181446ae5377 100644
--- a/drivers/media/platform/renesas/rcar-isp/core.c
+++ b/drivers/media/platform/renesas/rcar-isp/core.c
@@ -870,17 +870,23 @@ int risp_core_probe(struct rcar_isp_core *core, struct
platform_device *pdev,
ret = v4l2_device_register(core->dev, &core->v4l2_dev);
if (ret)
- return ret;
+ goto err_destroy_rpp;
ret = risp_core_create_subdev(core);
if (ret)
- return ret;
+ goto err_unregister_v4l2;
mutex_init(&core->io_lock);
spin_lock_init(&core->lock);
INIT_LIST_HEAD(&core->risp_jobs);
return 0;
+
+err_unregister_v4l2:
+ v4l2_device_unregister(&core->v4l2_dev);
+err_destroy_rpp:
+ rppx1_destroy(core->rpp);
+ return ret;
}
void risp_core_remove(struct rcar_isp_core *core)
@@ -894,7 +900,7 @@ void risp_core_remove(struct rcar_isp_core *core)
for (unsigned int i = 0; i < RISP_CORE_NUM_PADS; i++)
risp_core_io_destroy(&core->io[i]);
- v4l2_device_unregister_subdev(&core->subdev);
+ v4l2_device_unregister(&core->v4l2_dev);
mutex_destroy(&core->io_lock);
rppx1_destroy(core->rpp);
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
