[PATCH] media: coda: clear m2m_dev after releasing it in coda_fw_callback()

[PATCH] media: coda: clear m2m_dev after releasing it in coda_fw_callback()

[Thomas Fourier]

In coda_fw_callback(), if v4l2_m2m_init() or coda_register_device() fail,
v4l2_m2m_release() is called but dev->m2m_dev remains set.
v4l2_m2m_release() is also called in coda_remove(). This would lead to
a double free of dev->m2m_dev.

Clear dev->m2m_dev on error paths.

Fixes: 186b250a0725 ("[media] media: coda: Add driver for Coda video codec")
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
---
 drivers/media/platform/chips-media/coda/coda-common.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/platform/chips-media/coda/coda-common.c b/drivers/media/platform/chips-media/coda/coda-common.c
index be37ea568bfe..b1a656054b89 100644
--- a/drivers/media/platform/chips-media/coda/coda-common.c
+++ b/drivers/media/platform/chips-media/coda/coda-common.c
@@ -3023,6 +3023,7 @@ static void coda_fw_callback(const struct firmware *fw, void *context)
 	dev->m2m_dev = v4l2_m2m_init(&coda_m2m_ops);
 	if (IS_ERR(dev->m2m_dev)) {
 		v4l2_err(&dev->v4l2_dev, "Failed to init mem2mem device\n");
+		dev->m2m_dev = NULL;
 		goto put_pm;
 	}
 
@@ -3043,6 +3044,7 @@ static void coda_fw_callback(const struct firmware *fw, void *context)
 	while (--i >= 0)
 		video_unregister_device(&dev->vfd[i]);
 	v4l2_m2m_release(dev->m2m_dev);
+	dev->m2m_dev = NULL;
 put_pm:
 	pm_runtime_put_sync(dev->dev);
 }
-- 
2.53.0