[PATCH] media: mediatek: vcodec: fix decoder child device leaks

[PATCH] media: mediatek: vcodec: fix decoder child device leaks

[Guangshuo Li]

mtk_vcodec_probe() populates decoder hardware child platform devices on
platforms that support decoder subdevices. These children must be
removed with of_platform_depopulate() when they are no longer needed.

If initialization fails after the children have been populated, the
probe error path releases the parent decoder resources without
depopulating the child devices. This leaves the child platform devices
registered.

The remove path has the same issue and leaves the child devices
registered when the parent decoder driver is unbound.

Depopulate the child devices in the probe error path and in the remove
path before tearing down the remaining parent resources.

The issue was identified by a static analysis tool I developed and
confirmed by manual review.

Fixes: c05bada35f01 ("media: mtk-vcodec: Add to support multi hardware decode")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 .../platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c    | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
index e936ed8dffba..592685ad522c 100644
--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
+++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
@@ -517,6 +517,8 @@ static int mtk_vcodec_probe(struct platform_device *pdev)
 err_dec_mem_init:
 	video_unregister_device(vfd_dec);
 err_reg_cont:
+	if (dev->vdec_pdata->is_subdev_supported)
+		of_platform_depopulate(&pdev->dev);
 	if (dev->vdec_pdata->uses_stateless_api)
 		media_device_cleanup(&dev->mdev_dec);
 	destroy_workqueue(dev->decode_workqueue);
@@ -569,6 +571,9 @@ static void mtk_vcodec_dec_remove(struct platform_device *pdev)
 {
 	struct mtk_vcodec_dec_dev *dev = platform_get_drvdata(pdev);
 
+	if (dev->vdec_pdata->is_subdev_supported)
+		of_platform_depopulate(&pdev->dev);
+
 	destroy_workqueue(dev->decode_workqueue);
 
 	if (media_devnode_is_registered(dev->mdev_dec.devnode)) {
-- 
2.43.0

Re: [PATCH] media: mediatek: vcodec: fix decoder child device leaks

[Nicolas Dufresne]

[-- Attachment #1: Type: text/plain, Size: 2359 bytes --]

Le lundi 21 septembre 2026 à 17:08 +0800, Guangshuo Li a écrit :
> mtk_vcodec_probe() populates decoder hardware child platform devices on
> platforms that support decoder subdevices. These children must be
> removed with of_platform_depopulate() when they are no longer needed.
> 
> If initialization fails after the children have been populated, the
> probe error path releases the parent decoder resources without
> depopulating the child devices. This leaves the child platform devices
> registered.
> 
> The remove path has the same issue and leaves the child devices
> registered when the parent decoder driver is unbound.
> 
> Depopulate the child devices in the probe error path and in the remove
> path before tearing down the remaining parent resources.
> 
> The issue was identified by a static analysis tool I developed and
> confirmed by manual review.
> 
> Fixes: c05bada35f01 ("media: mtk-vcodec: Add to support multi hardware decode")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  .../platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c    | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
> index e936ed8dffba..592685ad522c 100644
> --- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
> +++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
> @@ -517,6 +517,8 @@ static int mtk_vcodec_probe(struct platform_device *pdev)
>  err_dec_mem_init:
>  	video_unregister_device(vfd_dec);
>  err_reg_cont:
> +	if (dev->vdec_pdata->is_subdev_supported)
> +		of_platform_depopulate(&pdev->dev);
>  	if (dev->vdec_pdata->uses_stateless_api)
>  		media_device_cleanup(&dev->mdev_dec);
>  	destroy_workqueue(dev->decode_workqueue);
> @@ -569,6 +571,9 @@ static void mtk_vcodec_dec_remove(struct platform_device *pdev)
>  {
>  	struct mtk_vcodec_dec_dev *dev = platform_get_drvdata(pdev);
>  
> +	if (dev->vdec_pdata->is_subdev_supported)
> +		of_platform_depopulate(&pdev->dev);
> +
>  	destroy_workqueue(dev->decode_workqueue);

This was first for a reason, please keep first.

Nicolas

>  
>  	if (media_devnode_is_registered(dev->mdev_dec.devnode)) {

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 228 bytes --]