drm/imx: imx-tve: release a device reference obtained in .probe() on error

Commit Message

Joe Hattori Dec. 15, 2024, 4:15 a.m. UTC

imx_tve_probe() calls of_find_i2c_adapter_by_node() to obtain an
i2c_client with an incremented refcount, but does not release it on
error. Fix this by calling devm_add_action_or_reset() with a new
function imx_tve_release_ddc(), which releases the reference.

This bug was found by an experimental static analysis tool that I am
developing.

Fixes: a91cfaf6e650 ("drm/imx: imx-tve: move initialization into probe")
Signed-off-by: Joe Hattori <[e-mail]>
---
 drivers/gpu/drm/imx/ipuv3/imx-tve.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

Patch

diff --git a/drivers/gpu/drm/imx/ipuv3/imx-tve.c b/drivers/gpu/drm/imx/ipuv3/imx-tve.c
index 3a3c8a195119..8d7af3514128 100644
--- a/drivers/gpu/drm/imx/ipuv3/imx-tve.c
+++ b/drivers/gpu/drm/imx/ipuv3/imx-tve.c
@@ -525,6 +525,13 @@  static const struct component_ops imx_tve_ops = {
 	.bind	= imx_tve_bind,
 };
 
+static void imx_tve_release_ddc(void *data)
+{
+	struct imx_tve *tve = data;
+
+	put_device(&tve->ddc->dev);
+}
+
 static int imx_tve_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
@@ -546,6 +553,9 @@  static int imx_tve_probe(struct platform_device *pdev)
 	if (ddc_node) {
 		tve->ddc = of_find_i2c_adapter_by_node(ddc_node);
 		of_node_put(ddc_node);
+		ret = devm_add_action_or_reset(dev, imx_tve_release_ddc, tve);
+		if (ret)
+			return ret;
 	}
 
 	tve->mode = of_get_tve_mode(np);