[PATCH v2 1/2] media: rcar-isp: Release ISPCORE resources

[Linmao Li]

v4l2_device_register() takes a reference to the parent device, but the
ISPCORE remove path never calls v4l2_device_unregister(). The reference
is therefore leaked whenever an ISPCORE is removed.

Probe failures after rppx1_create() also return without destroying the
RPPX1 object.

Unregister the V4L2 device and destroy the RPPX1 object on the
corresponding error paths, and unregister the V4L2 device during removal.
v4l2_device_unregister() also unregisters all attached subdevices, so it
replaces the narrower subdevice-only cleanup.

Signed-off-by: Linmao Li <lilinmao@xxxxxxxxxx>
Reviewed-by: Jacopo Mondi <jacopo.mondi@xxxxxxxxxxxxxxxx>
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@xxxxxxxxxxxx>
---
 drivers/media/platform/renesas/rcar-isp/core.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/media/platform/renesas/rcar-isp/core.c b/drivers/media/platform/renesas/rcar-isp/core.c
index f3dc52c136120..181446ae53779 100644
--- a/drivers/media/platform/renesas/rcar-isp/core.c
+++ b/drivers/media/platform/renesas/rcar-isp/core.c
@@ -870,17 +870,23 @@ int risp_core_probe(struct rcar_isp_core *core, struct platform_device *pdev,
 
 	ret = v4l2_device_register(core->dev, &core->v4l2_dev);
 	if (ret)
-		return ret;
+		goto err_destroy_rpp;
 
 	ret = risp_core_create_subdev(core);
 	if (ret)
-		return ret;
+		goto err_unregister_v4l2;
 
 	mutex_init(&core->io_lock);
 	spin_lock_init(&core->lock);
 	INIT_LIST_HEAD(&core->risp_jobs);
 
 	return 0;
+
+err_unregister_v4l2:
+	v4l2_device_unregister(&core->v4l2_dev);
+err_destroy_rpp:
+	rppx1_destroy(core->rpp);
+	return ret;
 }
 
 void risp_core_remove(struct rcar_isp_core *core)
@@ -894,7 +900,7 @@ void risp_core_remove(struct rcar_isp_core *core)
 	for (unsigned int i = 0; i < RISP_CORE_NUM_PADS; i++)
 		risp_core_io_destroy(&core->io[i]);
 
-	v4l2_device_unregister_subdev(&core->subdev);
+	v4l2_device_unregister(&core->v4l2_dev);
 
 	mutex_destroy(&core->io_lock);
 	rppx1_destroy(core->rpp);
-- 
2.25.1