[PATCH] media: i2c: vgxy61: free control handler on remove

[Guangshuo Li]

vgxy61_init_controls() initializes a V4L2 control handler and assigns
it to the subdevice. The probe failure paths release the handler with
v4l2_ctrl_handler_free(), but the remove path does not perform the
corresponding cleanup.

As a result, removing the driver after a successful probe leaks the
resources allocated for the V4L2 controls.

Free the control handler during remove. Do so before destroying the
sensor mutex, which is also used as the control handler lock, matching
the cleanup order used by the probe failure path.

This issue was found by manual code inspection.

Fixes: 153e4ad44d605 ("media: i2c: Add driver for ST VGXY61 camera sensor")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
---
 drivers/media/i2c/vgxy61.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/i2c/vgxy61.c b/drivers/media/i2c/vgxy61.c
index 3fb2166c81ef..553ab5a2e265 100644
--- a/drivers/media/i2c/vgxy61.c
+++ b/drivers/media/i2c/vgxy61.c
@@ -1876,8 +1876,9 @@ static void vgxy61_remove(struct i2c_client *client)
 	struct vgxy61_dev *sensor = to_vgxy61_dev(sd);
 
 	v4l2_async_unregister_subdev(&sensor->sd);
-	mutex_destroy(&sensor->lock);
 	media_entity_cleanup(&sensor->sd.entity);
+	v4l2_ctrl_handler_free(sensor->sd.ctrl_handler);
+	mutex_destroy(&sensor->lock);
 
 	pm_runtime_disable(&client->dev);
 	if (!pm_runtime_status_suspended(&client->dev))
-- 
2.43.0