[PATCH] media: adv748x: Fix endpoint reference leaks on probe failure

[PATCH] media: adv748x: Fix endpoint reference leaks on probe failure

[Ruoyu Wang]

adv748x_parse_dt() takes an extra reference for every endpoint saved in
state->endpoints. If parsing later fails, adv748x_probe() skips
adv748x_dt_cleanup(), so the saved references remain held. A CSI-2 lane
parsing error also returns from for_each_endpoint_of_node() without
dropping the iterator's reference.

Drop the iterator reference before returning a lane parsing error and
route all parse failures through the endpoint cleanup path. This balances
both reference classes while retaining the endpoints for a successful
probe.

This issue was found by a static analysis checker and confirmed by
manual source review.

Fixes: 6a18865da8e3 ("media: i2c: adv748x: store number of CSI-2 lanes described in device tree")
Fixes: eccf442ce156 ("media: i2c: adv748x: Support probing a single output")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
 drivers/media/i2c/adv748x/adv748x-core.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/media/i2c/adv748x/adv748x-core.c b/drivers/media/i2c/adv748x/adv748x-core.c
index 3eb6d5e8f0826..010a4c55b4002 100644
--- a/drivers/media/i2c/adv748x/adv748x-core.c
+++ b/drivers/media/i2c/adv748x/adv748x-core.c
@@ -689,8 +689,10 @@ static int adv748x_parse_dt(struct adv748x_state *state)
 
 		/* Store number of CSI-2 lanes used for TXA and TXB. */
 		ret = adv748x_parse_csi2_lanes(state, ep.port, ep_np);
-		if (ret)
+		if (ret) {
+			of_node_put(ep_np);
 			return ret;
+		}
 	}
 
 	return in_found && out_found ? 0 : -ENODEV;
@@ -739,7 +741,7 @@ static int adv748x_probe(struct i2c_client *client)
 	ret = adv748x_parse_dt(state);
 	if (ret) {
 		adv_err(state, "Failed to parse device tree");
-		goto err_free_mutex;
+		goto err_cleanup_dt;
 	}
 
 	/* Configure IO Regmap region */
@@ -809,7 +811,6 @@ static int adv748x_probe(struct i2c_client *client)
 	adv748x_unregister_clients(state);
 err_cleanup_dt:
 	adv748x_dt_cleanup(state);
-err_free_mutex:
 	mutex_destroy(&state->mutex);
 
 	return ret;
-- 
2.51.0

Re: [PATCH] media: adv748x: Fix endpoint reference leaks on probe failure

[Hans Verkuil]

On 14/08/2026 15:41, Ruoyu Wang wrote:
> adv748x_parse_dt() takes an extra reference for every endpoint saved in
> state->endpoints. If parsing later fails, adv748x_probe() skips
> adv748x_dt_cleanup(), so the saved references remain held. A CSI-2 lane
> parsing error also returns from for_each_endpoint_of_node() without
> dropping the iterator's reference.
> 
> Drop the iterator reference before returning a lane parsing error and
> route all parse failures through the endpoint cleanup path. This balances
> both reference classes while retaining the endpoints for a successful
> probe.
> 
> This issue was found by a static analysis checker and confirmed by
> manual source review.
> 
> Fixes: 6a18865da8e3 ("media: i2c: adv748x: store number of CSI-2 lanes described in device tree")
> Fixes: eccf442ce156 ("media: i2c: adv748x: Support probing a single output")
> Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
> ---
>  drivers/media/i2c/adv748x/adv748x-core.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/media/i2c/adv748x/adv748x-core.c b/drivers/media/i2c/adv748x/adv748x-core.c
> index 3eb6d5e8f0826..010a4c55b4002 100644
> --- a/drivers/media/i2c/adv748x/adv748x-core.c
> +++ b/drivers/media/i2c/adv748x/adv748x-core.c
> @@ -689,8 +689,10 @@ static int adv748x_parse_dt(struct adv748x_state *state)
>  
>  		/* Store number of CSI-2 lanes used for TXA and TXB. */
>  		ret = adv748x_parse_csi2_lanes(state, ep.port, ep_np);
> -		if (ret)
> +		if (ret) {
> +			of_node_put(ep_np);

Shouldn't this set state->endpoints[ep.port] to NULL as well? Otherwise it will
be put again in adv748x_dt_cleanup(). Or better, wait with setting state->endpoints[ep.port]
until after this check.

Regards,

	Hans

>  			return ret;
> +		}
>  	}
>  
>  	return in_found && out_found ? 0 : -ENODEV;
> @@ -739,7 +741,7 @@ static int adv748x_probe(struct i2c_client *client)
>  	ret = adv748x_parse_dt(state);
>  	if (ret) {
>  		adv_err(state, "Failed to parse device tree");
> -		goto err_free_mutex;
> +		goto err_cleanup_dt;
>  	}
>  
>  	/* Configure IO Regmap region */
> @@ -809,7 +811,6 @@ static int adv748x_probe(struct i2c_client *client)
>  	adv748x_unregister_clients(state);
>  err_cleanup_dt:
>  	adv748x_dt_cleanup(state);
> -err_free_mutex:
>  	mutex_destroy(&state->mutex);
>  
>  	return ret;