[PATCH v2] media: v4l2-dev: fix media controller registration error handling

[Shih-Sheng Yang]

__video_register_device() ignores failures from
video_register_media_controller(). If media_devnode_create() fails,
vdev->intf_devnode remains NULL but the video device is still marked as
registered. A later video_unregister_device() reaches
v4l2_device_release(), which calls media_devnode_remove() and
dereferences the NULL pointer.

If media_create_intf_link() fails, video_register_media_controller()
removes vdev->intf_devnode but leaves the stale pointer behind.

Fix this by propagating video_register_media_controller() failures from
__video_register_device(). Since device_register() has already
succeeded, unwind the device with device_unregister(). Also make
media_devnode_remove() tolerate NULL devnodes and clear
vdev->intf_devnode after removing it in the link failure path.

Suggested-by: Laurent Pinchart <laurent.pinchart+renesas@xxxxxxxxxxxxxxxx>
Signed-off-by: Shih-Sheng Yang <yshihsheng@xxxxxxxxx>
---
v1: https://lore.kernel.org/r/20260625193916.3562596-1-yshihsheng@xxxxxxxxx

Changes in v2:
- Move the NULL check to media_devnode_remove().
- Use device_unregister() after device_register() has succeeded.
- Keep clearing vdev->intf_devnode in the link failure path.

 drivers/media/mc/mc-entity.c       | 3 +++
 drivers/media/v4l2-core/v4l2-dev.c | 6 ++++++
 2 files changed, 9 insertions(+)

diff --git a/drivers/media/mc/mc-entity.c b/drivers/media/mc/mc-entity.c
index 3fa0bc687851..79f55375e9d6 100644
--- a/drivers/media/mc/mc-entity.c
+++ b/drivers/media/mc/mc-entity.c
@@ -1563,6 +1563,9 @@ EXPORT_SYMBOL_GPL(media_devnode_create);
 
 void media_devnode_remove(struct media_intf_devnode *devnode)
 {
+	if (!devnode)
+		return;
+
 	media_remove_intf_links(&devnode->intf);
 	media_gobj_destroy(&devnode->intf.graph_obj);
 	kfree(devnode);
diff --git a/drivers/media/v4l2-core/v4l2-dev.c b/drivers/media/v4l2-core/v4l2-dev.c
index 5516b2bbb08f..56b51d5d49ae 100644
--- a/drivers/media/v4l2-core/v4l2-dev.c
+++ b/drivers/media/v4l2-core/v4l2-dev.c
@@ -896,6 +896,7 @@ static int video_register_media_controller(struct video_device *vdev)
 					      MEDIA_LNK_FL_IMMUTABLE);
 		if (!link) {
 			media_devnode_remove(vdev->intf_devnode);
+			vdev->intf_devnode = NULL;
 			media_device_unregister_entity(&vdev->entity);
 			return -ENOMEM;
 		}
@@ -1092,6 +1093,11 @@ int __video_register_device(struct video_device *vdev,
 
 	/* Part 5: Register the entity. */
 	ret = video_register_media_controller(vdev);
+	if (ret < 0) {
+		mutex_unlock(&videodev_lock);
+		device_unregister(&vdev->dev);
+		return ret;
+	}
 
 	/* Part 6: Activate this minor. The char device can now be used. */
 	set_bit(V4L2_FL_REGISTERED, &vdev->flags);
-- 
2.34.1