On Sat Mar 28 15:14:50 2026 +0000, David Carlier wrote:
> mali_c55_probe() calls of_reserved_mem_device_init() to associate
> reserved memory regions with the device. This function allocates a
> struct rmem_assigned_device and adds it to a global linked list, which
> must be explicitly released via of_reserved_mem_device_release() â there
> is no devm variant of this API.
>
> However, neither the probe error paths nor mali_c55_remove() called
> of_reserved_mem_device_release(). Any probe failure after the
> of_reserved_mem_device_init() call, as well as every normal device
> removal, leaked the reserved memory association on the global list.
>
> Fix this by adding an err_release_mem label at the end of the probe
> error chain and calling of_reserved_mem_device_release() in
> mali_c55_remove(). The remove teardown order is also corrected to call
> mali_c55_media_frameworks_deinit() before kfree(), mirroring the probe
> init order in reverse.
>
> Cc: [email protected]
> Fixes: d5f281f3dd29 ("media: mali-c55: Add Mali-C55 ISP driver")
> Signed-off-by: David Carlier <[email protected]>
> Reviewed-by: Jacopo Mondi <[email protected]>
> Signed-off-by: Jacopo Mondi <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/platform/arm/mali-c55/mali-c55-core.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
---
diff --git a/drivers/media/platform/arm/mali-c55/mali-c55-core.c
b/drivers/media/platform/arm/mali-c55/mali-c55-core.c
index 6505d3be9807..305b8cbb9d1c 100644
--- a/drivers/media/platform/arm/mali-c55/mali-c55-core.c
+++ b/drivers/media/platform/arm/mali-c55/mali-c55-core.c
@@ -806,8 +806,10 @@ static int mali_c55_probe(struct platform_device *pdev)
vb2_dma_contig_set_max_seg_size(dev, UINT_MAX);
ret = __mali_c55_power_on(mali_c55);
- if (ret)
- return dev_err_probe(dev, ret, "failed to power on\n");
+ if (ret) {
+ dev_err_probe(dev, ret, "failed to power on\n");
+ goto err_release_mem;
+ }
ret = mali_c55_check_hwcfg(mali_c55);
if (ret)
@@ -845,6 +847,8 @@ err_free_context_registers:
kfree(mali_c55->context.registers);
err_power_off:
__mali_c55_power_off(mali_c55);
+err_release_mem:
+ of_reserved_mem_device_release(dev);
return ret;
}
@@ -853,8 +857,9 @@ static void mali_c55_remove(struct platform_device *pdev)
{
struct mali_c55 *mali_c55 = platform_get_drvdata(pdev);
- kfree(mali_c55->context.registers);
mali_c55_media_frameworks_deinit(mali_c55);
+ kfree(mali_c55->context.registers);
+ of_reserved_mem_device_release(&pdev->dev);
}
static const struct of_device_id mali_c55_of_match[] = {
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
