mdp_probe() has two successful initialization paths, but mdp_remove() does not correctly tear down either of them. For the main MDP instance, mdp_m2m_device_register() registers an M2M video device whose release callback performs the final resource cleanup. The remove path only unregisters the V4L2 device and leaves the M2M video device registered, preventing the normal video device teardown path from releasing the resources associated with the MDP device. For secondary MDP instances, probe returns successfully after allocating an mdp_dev and storing it as driver data without registering an M2M video device. The remove path does not free this allocation, leaking it on driver unbind. If an M2M video device was registered, unregister the V4L2 device first and then unregister the M2M device so that its release callback can perform the final cleanup. Otherwise, free the mdp_dev directly. This issue was found by manual code inspection. Fixes: 61890ccaefaf ("media: platform: mtk-mdp3: add MediaTek MDP3 driver") Fixes: 4294b9d6c8c4 ("media: platform: mtk-mdp3: avoid multiple driver registrations") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c index f412aadb5996..bf5cc20af715 100644 --- a/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c +++ b/drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c @@ -374,7 +374,12 @@ static void mdp_remove(struct platform_device *pdev) { struct mdp_dev *mdp = platform_get_drvdata(pdev); - v4l2_device_unregister(&mdp->v4l2_dev); + if (mdp->m2m_vdev) { + v4l2_device_unregister(&mdp->v4l2_dev); + mdp_m2m_device_unregister(mdp); + } else { + kfree(mdp); + } dev_dbg(&pdev->dev, "%s driver unloaded\n", pdev->name); } -- 2.43.0