Re: [PATCH] media: renesas: ceu: free device data if video device is unregistered

[Laurent Pinchart <laurent.pinchart@ideasonboard.com>]

On Tue, Sep 15, 2026 at 09:54:06PM +0800, Guangshuo Li wrote:
> ceu_probe() allocates ceudev, while ceu_remove() does not free it if the
> video device has not been registered.
> 
> The video device is registered from the async notifier complete
> callback, and its release callback is responsible for freeing ceudev.
> If the device is removed before the notifier completes, or before video
> device registration succeeds, video_unregister_device() does not invoke
> the release callback and the ceudev allocation is leaked.
> 
> Check whether the video device was registered during remove. Unregister
> it normally when registered so that its release callback handles the
> final free, otherwise free ceudev directly.
> 
> This issue was found by manual code inspection.

That's hard to believe.

How have you tested this patch ?

> Fixes: 32e5a70dc8f4 ("media: platform: Add Renesas CEU driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  drivers/media/platform/renesas/renesas-ceu.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/platform/renesas/renesas-ceu.c b/drivers/media/platform/renesas/renesas-ceu.c
> index 65f7659a9e02..5015b7837381 100644
> --- a/drivers/media/platform/renesas/renesas-ceu.c
> +++ b/drivers/media/platform/renesas/renesas-ceu.c
> @@ -1705,7 +1705,10 @@ static void ceu_remove(struct platform_device *pdev)
>  
>  	v4l2_device_unregister(&ceudev->v4l2_dev);
>  
> -	video_unregister_device(&ceudev->vdev);
> +	if (video_is_registered(&ceudev->vdev))
> +		video_unregister_device(&ceudev->vdev);
> +	else
> +		kfree(ceudev);
>  }
>  
>  static const struct dev_pm_ops ceu_pm_ops = {

-- 
Regards,

Laurent Pinchart