Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6fd38ba4 authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by Greg Kroah-Hartman
Browse files

media: fsl-viu: fix error handling in viu_of_probe() 



[ Upstream commit 662a99e145661c2b35155cf375044deae9b79896 ]

viu_of_probe() ignores fails in i2c_get_adapter(),
tries to unlock uninitialized mutex on error path.

The patch streamlining the error handling in viu_of_probe().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: default avatarSasha Levin <alexander.levin@microsoft.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 769ae06e

drivers/media/platform/fsl-viu.c

+23 −15
Original line number Diff line number Diff line
@@ -1417,7 +1417,7 @@ static int viu_of_probe(struct platform_device *op) 
				     sizeof(struct viu_reg), DRV_NAME)) {

		dev_err(&op->dev, "Error while requesting mem region\n");

		ret = -EBUSY;

		goto err;

		goto err_irq;

	}



	/* remap registers */
@@ -1425,7 +1425,7 @@ static int viu_of_probe(struct platform_device *op) 
	if (!viu_regs) {

		dev_err(&op->dev, "Can't map register set\n");

		ret = -ENOMEM;

		goto err;

		goto err_irq;

	}



	/* Prepare our private structure */
@@ -1433,7 +1433,7 @@ static int viu_of_probe(struct platform_device *op) 
	if (!viu_dev) {

		dev_err(&op->dev, "Can't allocate private structure\n");

		ret = -ENOMEM;

		goto err;

		goto err_irq;

	}



	viu_dev->vr = viu_regs;
@@ -1449,16 +1449,21 @@ static int viu_of_probe(struct platform_device *op) 
	ret = v4l2_device_register(viu_dev->dev, &viu_dev->v4l2_dev);

	if (ret < 0) {

		dev_err(&op->dev, "v4l2_device_register() failed: %d\n", ret);

		goto err;

		goto err_irq;

	}



	ad = i2c_get_adapter(0);

	if (!ad) {

		ret = -EFAULT;

		dev_err(&op->dev, "couldn't get i2c adapter\n");

		goto err_v4l2;

	}



	v4l2_ctrl_handler_init(&viu_dev->hdl, 5);

	if (viu_dev->hdl.error) {

		ret = viu_dev->hdl.error;

		dev_err(&op->dev, "couldn't register control\n");

		goto err_vdev;

		goto err_i2c;

	}

	/* This control handler will inherit the control(s) from the

	   sub-device(s). */
@@ -1475,7 +1480,7 @@ static int viu_of_probe(struct platform_device *op) 
	vdev = video_device_alloc();

	if (vdev == NULL) {

		ret = -ENOMEM;

		goto err_vdev;

		goto err_hdl;

	}



	*vdev = viu_template;
@@ -1496,7 +1501,7 @@ static int viu_of_probe(struct platform_device *op) 
	ret = video_register_device(viu_dev->vdev, VFL_TYPE_GRABBER, -1);

	if (ret < 0) {

		video_device_release(viu_dev->vdev);

		goto err_vdev;

		goto err_unlock;

	}



	/* enable VIU clock */
@@ -1504,12 +1509,12 @@ static int viu_of_probe(struct platform_device *op) 
	if (IS_ERR(clk)) {

		dev_err(&op->dev, "failed to lookup the clock!\n");

		ret = PTR_ERR(clk);

		goto err_clk;

		goto err_vdev;

	}

	ret = clk_prepare_enable(clk);

	if (ret) {

		dev_err(&op->dev, "failed to enable the clock!\n");

		goto err_clk;

		goto err_vdev;

	}

	viu_dev->clk = clk;
@@ -1520,7 +1525,7 @@ static int viu_of_probe(struct platform_device *op) 
	if (request_irq(viu_dev->irq, viu_intr, 0, "viu", (void *)viu_dev)) {

		dev_err(&op->dev, "Request VIU IRQ failed.\n");

		ret = -ENODEV;

		goto err_irq;

		goto err_clk;

	}



	mutex_unlock(&viu_dev->lock);
@@ -1528,16 +1533,19 @@ static int viu_of_probe(struct platform_device *op) 
	dev_info(&op->dev, "Freescale VIU Video Capture Board\n");

	return ret;



err_irq:

	clk_disable_unprepare(viu_dev->clk);

err_clk:

	video_unregister_device(viu_dev->vdev);

	clk_disable_unprepare(viu_dev->clk);

err_vdev:

	v4l2_ctrl_handler_free(&viu_dev->hdl);

	video_unregister_device(viu_dev->vdev);

err_unlock:

	mutex_unlock(&viu_dev->lock);

err_hdl:

	v4l2_ctrl_handler_free(&viu_dev->hdl);

err_i2c:

	i2c_put_adapter(ad);

err_v4l2:

	v4l2_device_unregister(&viu_dev->v4l2_dev);

err:

err_irq:

	irq_dispose_mapping(viu_irq);

	return ret;

}