[PATCH] media: mediatek: vcodec: fix decoder child device leaks

[Nicolas Dufresne]

Le lundi 21 septembre 2026 à 17:08 +0800, Guangshuo Li a écrit :
> mtk_vcodec_probe() populates decoder hardware child platform devices on
> platforms that support decoder subdevices. These children must be
> removed with of_platform_depopulate() when they are no longer needed.
> 
> If initialization fails after the children have been populated, the
> probe error path releases the parent decoder resources without
> depopulating the child devices. This leaves the child platform devices
> registered.
> 
> The remove path has the same issue and leaves the child devices
> registered when the parent decoder driver is unbound.
> 
> Depopulate the child devices in the probe error path and in the remove
> path before tearing down the remaining parent resources.
> 
> The issue was identified by a static analysis tool I developed and
> confirmed by manual review.
> 
> Fixes: c05bada35f01 ("media: mtk-vcodec: Add to support multi hardware decode")
> Cc: stable at vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244 at gmail.com>
> ---
>  .../platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c    | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
> index e936ed8dffba..592685ad522c 100644
> --- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
> +++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
> @@ -517,6 +517,8 @@ static int mtk_vcodec_probe(struct platform_device *pdev)
>  err_dec_mem_init:
>  	video_unregister_device(vfd_dec);
>  err_reg_cont:
> +	if (dev->vdec_pdata->is_subdev_supported)
> +		of_platform_depopulate(&pdev->dev);
>  	if (dev->vdec_pdata->uses_stateless_api)
>  		media_device_cleanup(&dev->mdev_dec);
>  	destroy_workqueue(dev->decode_workqueue);
> @@ -569,6 +571,9 @@ static void mtk_vcodec_dec_remove(struct platform_device *pdev)
>  {
>  	struct mtk_vcodec_dec_dev *dev = platform_get_drvdata(pdev);
>  
> +	if (dev->vdec_pdata->is_subdev_supported)
> +		of_platform_depopulate(&pdev->dev);
> +
>  	destroy_workqueue(dev->decode_workqueue);

This was first for a reason, please keep first.

Nicolas

>  
>  	if (media_devnode_is_registered(dev->mdev_dec.devnode)) {
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: This is a digitally signed message part
URL: <http://lists.infradead.org/pipermail/linux-mediatek/attachments/20260929/f88574ce/attachment.sig>