[PATCH] media: renesas: ceu: free device data if video device is unregistered

[PATCH] media: renesas: ceu: free device data if video device is unregistered

[Guangshuo Li]

ceu_probe() allocates ceudev, while ceu_remove() does not free it if the
video device has not been registered.

The video device is registered from the async notifier complete
callback, and its release callback is responsible for freeing ceudev.
If the device is removed before the notifier completes, or before video
device registration succeeds, video_unregister_device() does not invoke
the release callback and the ceudev allocation is leaked.

Check whether the video device was registered during remove. Unregister
it normally when registered so that its release callback handles the
final free, otherwise free ceudev directly.

This issue was found by manual code inspection.

Fixes: 32e5a70dc8f4 ("media: platform: Add Renesas CEU driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/media/platform/renesas/renesas-ceu.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/renesas/renesas-ceu.c b/drivers/media/platform/renesas/renesas-ceu.c
index 65f7659a9e02..5015b7837381 100644
--- a/drivers/media/platform/renesas/renesas-ceu.c
+++ b/drivers/media/platform/renesas/renesas-ceu.c
@@ -1705,7 +1705,10 @@ static void ceu_remove(struct platform_device *pdev)
 
 	v4l2_device_unregister(&ceudev->v4l2_dev);
 
-	video_unregister_device(&ceudev->vdev);
+	if (video_is_registered(&ceudev->vdev))
+		video_unregister_device(&ceudev->vdev);
+	else
+		kfree(ceudev);
 }
 
 static const struct dev_pm_ops ceu_pm_ops = {
-- 
2.43.0

Re: [PATCH] media: renesas: ceu: free device data if video device is unregistered

[Laurent Pinchart]

On Tue, Sep 15, 2026 at 09:54:06PM +0800, Guangshuo Li wrote:
> ceu_probe() allocates ceudev, while ceu_remove() does not free it if the
> video device has not been registered.
> 
> The video device is registered from the async notifier complete
> callback, and its release callback is responsible for freeing ceudev.
> If the device is removed before the notifier completes, or before video
> device registration succeeds, video_unregister_device() does not invoke
> the release callback and the ceudev allocation is leaked.
> 
> Check whether the video device was registered during remove. Unregister
> it normally when registered so that its release callback handles the
> final free, otherwise free ceudev directly.
> 
> This issue was found by manual code inspection.

That's hard to believe.

How have you tested this patch ?

> Fixes: 32e5a70dc8f4 ("media: platform: Add Renesas CEU driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  drivers/media/platform/renesas/renesas-ceu.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/platform/renesas/renesas-ceu.c b/drivers/media/platform/renesas/renesas-ceu.c
> index 65f7659a9e02..5015b7837381 100644
> --- a/drivers/media/platform/renesas/renesas-ceu.c
> +++ b/drivers/media/platform/renesas/renesas-ceu.c
> @@ -1705,7 +1705,10 @@ static void ceu_remove(struct platform_device *pdev)
>  
>  	v4l2_device_unregister(&ceudev->v4l2_dev);
>  
> -	video_unregister_device(&ceudev->vdev);
> +	if (video_is_registered(&ceudev->vdev))
> +		video_unregister_device(&ceudev->vdev);
> +	else
> +		kfree(ceudev);
>  }
>  
>  static const struct dev_pm_ops ceu_pm_ops = {

-- 
Regards,

Laurent Pinchart