[PATCH] media: cx231xx: free the rc device if IR client creation fails

[Wentao Liang]

cx231xx_ir_init() allocates an rc device and hands it to the
ir-kbd-i2c driver through the I2C board info.  It then ignores the
return value of i2c_new_client_device().

If the client cannot be created, ir-kbd-i2c is never probed and its
remove callback, which owns and frees the rc device, never runs.  The
allocation is therefore leaked.  In addition, the error pointer is left
in dev->ir_i2c_client, which cx231xx_ir_exit() later passes to
i2c_unregister_device().

Check for an error pointer, free the rc device, clear the client pointer
and return the error.

Fixes: 141bb0dc2d0a ("[media] cx231xx: Fix i2c support at cx231xx-input")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/media/usb/cx231xx/cx231xx-input.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/media/usb/cx231xx/cx231xx-input.c b/drivers/media/usb/cx231xx/cx231xx-input.c
index 8149702bcf89..1236a04cb2d6 100644
--- a/drivers/media/usb/cx231xx/cx231xx-input.c
+++ b/drivers/media/usb/cx231xx/cx231xx-input.c
@@ -50,6 +50,7 @@ int cx231xx_ir_init(struct cx231xx *dev)
 {
 	struct i2c_board_info info;
 	u8 ir_i2c_bus;
+	int ret;
 
 	dev_dbg(dev->dev, "%s\n", __func__);
 
@@ -90,6 +91,13 @@ int cx231xx_ir_init(struct cx231xx *dev)
 		ir_i2c_bus, info.addr);
 	dev->ir_i2c_client = i2c_new_client_device(
 		cx231xx_get_i2c_adap(dev, ir_i2c_bus), &info);
+	if (IS_ERR(dev->ir_i2c_client)) {
+		ret = PTR_ERR(dev->ir_i2c_client);
+		rc_free_device(dev->init_data.rc_dev);
+		dev->init_data.rc_dev = NULL;
+		dev->ir_i2c_client = NULL;
+		return ret;
+	}
 
 	return 0;
 }
-- 
2.34.1