imx_tve_probe() calls of_find_i2c_adapter_by_node() to obtain an
i2c_client with an incremented refcount, but does not release it on
error. Fix this by calling devm_add_action_or_reset() with a new
function imx_tve_release_ddc(), which releases the reference.
This bug was found by an experimental static analysis tool that I am
developing.
Fixes: a91cfaf6e650 ("drm/imx: imx-tve: move initialization into probe")
Signed-off-by: Joe Hattori <joe@xxxxxxxxxxxxxxxxxxxxx>
---
drivers/gpu/drm/imx/ipuv3/imx-tve.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/gpu/drm/imx/ipuv3/imx-tve.c b/drivers/gpu/drm/imx/ipuv3/imx-tve.c
index 3a3c8a195119..8d7af3514128 100644
--- a/drivers/gpu/drm/imx/ipuv3/imx-tve.c
+++ b/drivers/gpu/drm/imx/ipuv3/imx-tve.c
@@ -525,6 +525,13 @@ static const struct component_ops imx_tve_ops = {
.bind = imx_tve_bind,
};
+static void imx_tve_release_ddc(void *data)
+{
+ struct imx_tve *tve = data;
+
+ put_device(&tve->ddc->dev);
+}
+
static int imx_tve_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
@@ -546,6 +553,9 @@ static int imx_tve_probe(struct platform_device *pdev)
if (ddc_node) {
tve->ddc = of_find_i2c_adapter_by_node(ddc_node);
of_node_put(ddc_node);
+ ret = devm_add_action_or_reset(dev, imx_tve_release_ddc, tve);
+ if (ret)
+ return ret;
}
tve->mode = of_get_tve_mode(np);
--
2.34.1
