[PATCH] staging: most: video: fix refcount leak in comp_probe_channel()

[WenTao Liang]

If v4l2_device_register() fails in comp_probe_channel(), the
function frees the allocated mdev with kfree() without releasing the
reference count held by the embedded v4l2_device.  Because
v4l2_device_register() initializes a kref in the v4l2_device, the
reference count is already 1 on failure.  Dropping the last reference
must be done with v4l2_device_put() so that the release callback can
unregister the v4l2_device and free mdev.

Replace the kfree(mdev) with v4l2_device_put(&mdev->v4l2_dev).  The
error path for comp_register_videodev() failure already does this
correctly.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: 3d31c0cb6c12 ("Staging: most: add MOST driver's aim-v4l2 module")
Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>
---
 drivers/staging/most/video/video.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/most/video/video.c b/drivers/staging/most/video/video.c
index 04351f8ccccf..aa846959b217 100644
--- a/drivers/staging/most/video/video.c
+++ b/drivers/staging/most/video/video.c
@@ -491,7 +491,7 @@ static int comp_probe_channel(struct most_interface *iface, int channel_idx,
 	ret = v4l2_device_register(NULL, &mdev->v4l2_dev);
 	if (ret) {
 		pr_err("v4l2_device_register() failed\n");
-		kfree(mdev);
+		v4l2_device_put(&mdev->v4l2_dev);
 		return ret;
 	}
 
-- 
2.50.1 (Apple Git-155)