media: rcar-isp: Release ISPCORE resources

v4l2_device_register() takes a reference to the parent device, but the
ISPCORE remove path never calls v4l2_device_unregister(). The reference
is therefore leaked whenever an ISPCORE is removed.

Probe failures after rppx1_create() also return without destroying the
RPPX1 object.

Unregister the V4L2 device and destroy the RPPX1 object on the
corresponding error paths, and unregister the V4L2 device during removal.
v4l2_device_unregister() also unregisters all attached subdevices, so it
replaces the narrower subdevice-only cleanup.

Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>

1 files changed, 9 insertions, 3 deletions

diff --git a/drivers/media/platform/renesas/rcar-isp/core.c b/drivers/media/platform/renesas/rcar-isp/core.c
index f3dc52c13612..181446ae5377 100644
--- a/drivers/media/platform/renesas/rcar-isp/core.c
+++ b/drivers/media/platform/renesas/rcar-isp/core.c
@@ -870,17 +870,23 @@ int risp_core_probe(struct rcar_isp_core *core, struct platform_device *pdev,
 
 	ret = v4l2_device_register(core->dev, &core->v4l2_dev);
 	if (ret)
-		return ret;
+		goto err_destroy_rpp;
 
 	ret = risp_core_create_subdev(core);
 	if (ret)
-		return ret;
+		goto err_unregister_v4l2;
 
 	mutex_init(&core->io_lock);
 	spin_lock_init(&core->lock);
 	INIT_LIST_HEAD(&core->risp_jobs);
 
 	return 0;
+
+err_unregister_v4l2:
+	v4l2_device_unregister(&core->v4l2_dev);
+err_destroy_rpp:
+	rppx1_destroy(core->rpp);
+	return ret;
 }
 
 void risp_core_remove(struct rcar_isp_core *core)
@@ -894,7 +900,7 @@ void risp_core_remove(struct rcar_isp_core *core)
 	for (unsigned int i = 0; i < RISP_CORE_NUM_PADS; i++)
 		risp_core_io_destroy(&core->io[i]);
 
-	v4l2_device_unregister_subdev(&core->subdev);
+	v4l2_device_unregister(&core->v4l2_dev);
 
 	mutex_destroy(&core->io_lock);
 	rppx1_destroy(core->rpp);