ceu_probe() allocates ceudev, while ceu_remove() does not free it if the video device has not been registered. The video device is registered from the async notifier complete callback, and its release callback is responsible for freeing ceudev. If the device is removed before the notifier completes, or before video device registration succeeds, video_unregister_device() does not invoke the release callback and the ceudev allocation is leaked. Check whether the video device was registered during remove. Unregister it normally when registered so that its release callback handles the final free, otherwise free ceudev directly. This issue was found by manual code inspection. Fixes: 32e5a70dc8f4 ("media: platform: Add Renesas CEU driver") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/media/platform/renesas/renesas-ceu.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/renesas/renesas-ceu.c b/drivers/media/platform/renesas/renesas-ceu.c index 65f7659a9e02..5015b7837381 100644 --- a/drivers/media/platform/renesas/renesas-ceu.c +++ b/drivers/media/platform/renesas/renesas-ceu.c @@ -1705,7 +1705,10 @@ static void ceu_remove(struct platform_device *pdev) v4l2_device_unregister(&ceudev->v4l2_dev); - video_unregister_device(&ceudev->vdev); + if (video_is_registered(&ceudev->vdev)) + video_unregister_device(&ceudev->vdev); + else + kfree(ceudev); } static const struct dev_pm_ops ceu_pm_ops = { -- 2.43.0