On Fri Sep 11 09:56:40 2026 +0800, Ruoyu Wang wrote:
> adv748x_parse_dt() takes an extra reference for every endpoint saved in
> state->endpoints. If parsing later fails, adv748x_probe() skips
> adv748x_dt_cleanup(), so the saved references remain held. A CSI-2 lane
> parsing error also returns from for_each_endpoint_of_node() without
> dropping the iterator's reference.
>
> Save the endpoint reference only after lane parsing succeeds. Drop the
> iterator reference before returning a lane parsing error and route all
> parse failures through the endpoint cleanup path to release any saved
> references. This retains the endpoints only for a successful probe.
>
> This issue was found by a static analysis checker and confirmed by
> manual source review.
>
> Fixes: 6a18865da8e3 ("media: i2c: adv748x: store number of CSI-2 lanes
> described in device tree")
> Fixes: eccf442ce156 ("media: i2c: adv748x: Support probing a single output")
> Cc: [email protected]
> Suggested-by: Hans Verkuil <[email protected]>
> Signed-off-by: Ruoyu Wang <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/i2c/adv748x/adv748x-core.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
---
diff --git a/drivers/media/i2c/adv748x/adv748x-core.c
b/drivers/media/i2c/adv748x/adv748x-core.c
index 3eb6d5e8f082..70594d001804 100644
--- a/drivers/media/i2c/adv748x/adv748x-core.c
+++ b/drivers/media/i2c/adv748x/adv748x-core.c
@@ -675,9 +675,6 @@ static int adv748x_parse_dt(struct adv748x_state *state)
continue;
}
- of_node_get(ep_np);
- state->endpoints[ep.port] = ep_np;
-
/*
* At least one input endpoint and one output endpoint shall
* be defined.
@@ -689,8 +686,13 @@ static int adv748x_parse_dt(struct adv748x_state *state)
/* Store number of CSI-2 lanes used for TXA and TXB. */
ret = adv748x_parse_csi2_lanes(state, ep.port, ep_np);
- if (ret)
+ if (ret) {
+ of_node_put(ep_np);
return ret;
+ }
+
+ of_node_get(ep_np);
+ state->endpoints[ep.port] = ep_np;
}
return in_found && out_found ? 0 : -ENODEV;
@@ -739,7 +741,7 @@ static int adv748x_probe(struct i2c_client *client)
ret = adv748x_parse_dt(state);
if (ret) {
adv_err(state, "Failed to parse device tree");
- goto err_free_mutex;
+ goto err_cleanup_dt;
}
/* Configure IO Regmap region */
@@ -809,7 +811,6 @@ err_cleanup_clients:
adv748x_unregister_clients(state);
err_cleanup_dt:
adv748x_dt_cleanup(state);
-err_free_mutex:
mutex_destroy(&state->mutex);
return ret;
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
