[PATCH] media: v4l2-dev: fix media controller registration error handling

[Shih-Sheng Yang]

__video_register_device() registers the media-controller entity and
interface after cdev_add() and device_register().

The return value from video_register_media_controller() is currently
ignored. If media_devnode_create() fails, vdev->intf_devnode remains
NULL, but the video device is still marked as registered and the caller
sees a successful registration. A later video_unregister_device() reaches
v4l2_device_release(), which calls media_devnode_remove() and
dereferences that NULL pointer.

If media_create_intf_link() fails, the helper removes
vdev->intf_devnode but leaves the stale pointer behind. A later release
path may then try to remove it again.

Fix this by propagating video_register_media_controller() failures from
__video_register_device(). Also make the media-controller cleanup path
tolerate partially-created state by clearing vdev->intf_devnode after
removal and checking it before release-time removal.

Signed-off-by: Shih-Sheng Yang <yshihsheng@xxxxxxxxx>
---
 drivers/media/v4l2-core/v4l2-dev.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/media/v4l2-core/v4l2-dev.c b/drivers/media/v4l2-core/v4l2-dev.c
index 6ce623a1245a..5d2faed002a7 100644
--- a/drivers/media/v4l2-core/v4l2-dev.c
+++ b/drivers/media/v4l2-core/v4l2-dev.c
@@ -203,7 +203,10 @@ static void v4l2_device_release(struct device *cd)
 #if defined(CONFIG_MEDIA_CONTROLLER)
 	if (v4l2_dev->mdev && vdev->vfl_dir != VFL_DIR_M2M) {
 		/* Remove interfaces and interface links */
-		media_devnode_remove(vdev->intf_devnode);
+		if (vdev->intf_devnode) {
+			media_devnode_remove(vdev->intf_devnode);
+			vdev->intf_devnode = NULL;
+		}
 		if (vdev->entity.function != MEDIA_ENT_F_UNKNOWN)
 			media_device_unregister_entity(&vdev->entity);
 	}
@@ -896,6 +899,7 @@ static int video_register_media_controller(struct video_device *vdev)
 					      MEDIA_LNK_FL_IMMUTABLE);
 		if (!link) {
 			media_devnode_remove(vdev->intf_devnode);
+			vdev->intf_devnode = NULL;
 			media_device_unregister_entity(&vdev->entity);
 			return -ENOMEM;
 		}
@@ -1087,6 +1091,11 @@ int __video_register_device(struct video_device *vdev,
 
 	/* Part 5: Register the entity. */
 	ret = video_register_media_controller(vdev);
+	if (ret < 0) {
+		mutex_unlock(&videodev_lock);
+		put_device(&vdev->dev);
+		return ret;
+	}
 
 	/* Part 6: Activate this minor. The char device can now be used. */
 	set_bit(V4L2_FL_REGISTERED, &vdev->flags);
-- 
2.34.1