Hi,

Le mercredi 17 septembre 2025 à 17:40 +0800, Haoxiang Li a écrit :

Add check for the return value of vpu_get_plat_device() to prevent null pointer dereference. And vpu_get_plat_device() increases the reference count of the returned platform device. Add platform_device_put() to prevent reference leak. Also add platform_device_put() in mtk_mdp_remove().

I think we should improve the subject a little. What about ?

media: mtk-mdp: Fix error handling in probe function

Nicolas

Add mtk_mdp_unregister_m2m_device() on the error handling path.

Fixes: c8eb2d7e8202 ("[media] media: Add Mediatek MDP Driver") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li haoxiang_li2024@163.com

---

Changes in v2:

• Add check for vpu_get_plat_device()
• Add platform_device_put() in mtk_mdp_remove()
• Add mtk_mdp_unregister_m2m_device() on the error handling path.
• Modify the patch title and description. I think you are right.

Thanks, CJ!

.../media/platform/mediatek/mdp/mtk_mdp_core.c  | 17 +++++++++++++++--  1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c b/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c index 80fdc6ff57e0..8432833814f3 100644 --- a/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c +++ b/drivers/media/platform/mediatek/mdp/mtk_mdp_core.c @@ -194,11 +194,17 @@ static int mtk_mdp_probe(struct platform_device *pdev)   }     mdp->vpu_dev = vpu_get_plat_device(pdev);

• if (!mdp->vpu_dev) {

• dev_err(&pdev->dev, "Failed to get vpu device\n");
  

• ret = -ENODEV;
  

• goto err_vpu_get_dev;
  

• }

ret = vpu_wdt_reg_handler(mdp->vpu_dev, mtk_mdp_reset_handler, mdp,     VPU_RST_MDP);   if (ret) {   dev_err(&pdev->dev, "Failed to register reset handler\n");

• goto err_m2m_register;
  

• goto err_reg_handler;
  

}     platform_set_drvdata(pdev, mdp); @@ -206,7 +212,7 @@ static int mtk_mdp_probe(struct platform_device *pdev)   ret = vb2_dma_contig_set_max_seg_size(&pdev->dev, DMA_BIT_MASK(32));   if (ret) {   dev_err(&pdev->dev, "Failed to set vb2 dma mag seg size\n");

• goto err_m2m_register;
  

• goto err_reg_handler;
  

}     pm_runtime_enable(dev); @@ -214,6 +220,12 @@ static int mtk_mdp_probe(struct platform_device *pdev)     return 0;   +err_reg_handler:

• platform_device_put(mdp->vpu_dev);

+err_vpu_get_dev:

• mtk_mdp_unregister_m2m_device(mdp);

err_m2m_register:   v4l2_device_unregister(&mdp->v4l2_dev);   @@ -242,6 +254,7 @@ static void mtk_mdp_remove(struct platform_device *pdev)     pm_runtime_disable(&pdev->dev);   vb2_dma_contig_clear_max_seg_size(&pdev->dev);

• platform_device_put(mdp->vpu_dev);

mtk_mdp_unregister_m2m_device(mdp);   v4l2_device_unregister(&mdp->v4l2_dev);