media: rp1: cfe: Fix use of freed memory on errors

cfe_probe_complete() calls cfe_put() on both success and fail code paths.
This works for the success path, but causes the cfe_device struct to be
freed, even if it will be used later in the teardown code.

Fix this by making the ref handling a bit saner: Let the video nodes
have the refs as they do now, but also keep a ref in the "main" driver,
released only at cfe_remove() time. This way the driver does not depend
on the video nodes keeping the refs.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>

diff --git a/drivers/media/platform/raspberrypi/rp1_cfe/cfe.c b/drivers/media/platform/raspberrypi/rp1_cfe/cfe.c
index 81c2098..fab0275 100644 (file)
--- a/drivers/media/platform/raspberrypi/rp1_cfe/cfe.c
+++ b/drivers/media/platform/raspberrypi/rp1_cfe/cfe.c
@@ -1837,17 +1837,10 @@ static int cfe_probe_complete(struct cfe_device *cfe)
                goto unregister;
        }
 
-       /*
-        * Release the initial reference, all references are now owned by the
-        * video devices.
-        */
-       cfe_put(cfe);
        return 0;
 
 unregister:
        cfe_unregister_nodes(cfe);
-       cfe_put(cfe);
-
        return ret;
 }
 
@@ -2129,6 +2122,8 @@ static int cfe_remove(struct platform_device *pdev)
 
        v4l2_device_unregister(&cfe->v4l2_dev);
 
+       cfe_put(cfe);
+
        return 0;
 }