V4L/DVB (12160): soc-camera: fix missing clean up on error path

If soc_camera_init_user_formats() fails in soc_camera_probe(), we have to call
client's .remove() method to unregister the video device.

Reported-by: Kuninori Morimoto <morimoto.kuninori@renesas.com>
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

1 files changed, 7 insertions, 3 deletions

diff --git a/drivers/media/video/soc_camera.c b/drivers/media/video/soc_camera.c
index 78010abfe8be..9f5ae8167855 100644
--- a/drivers/media/video/soc_camera.c
+++ b/drivers/media/video/soc_camera.c
@@ -877,8 +877,11 @@ static int soc_camera_probe(struct device *dev)
                         (unsigned short)~0;
 
                 ret = soc_camera_init_user_formats(icd);
-                if (ret < 0)
+                if (ret < 0) {
+                        if (icd->ops->remove)
+                                icd->ops->remove(icd);
                         goto eiufmt;
+                }
 
                 icd->height     = DEFAULT_HEIGHT;
                 icd->width      = DEFAULT_WIDTH;
@@ -902,8 +905,10 @@ static int soc_camera_remove(struct device *dev)
 {
         struct soc_camera_device *icd = to_soc_camera_dev(dev);
 
+        mutex_lock(&icd->video_lock);
         if (icd->ops->remove)
                 icd->ops->remove(icd);
+        mutex_unlock(&icd->video_lock);
 
         soc_camera_free_user_formats(icd);
 
@@ -1145,6 +1150,7 @@ evidallocd:
 }
 EXPORT_SYMBOL(soc_camera_video_start);
 
+/* Called from client .remove() methods with .video_lock held */
 void soc_camera_video_stop(struct soc_camera_device *icd)
 {
         struct video_device *vdev = icd->vdev;
@@ -1154,10 +1160,8 @@ void soc_camera_video_stop(struct soc_camera_device *icd)
         if (!icd->dev.parent || !vdev)
                 return;
 
-        mutex_lock(&icd->video_lock);
         video_unregister_device(vdev);
         icd->vdev = NULL;
-        mutex_unlock(&icd->video_lock);
 }
 EXPORT_SYMBOL(soc_camera_video_stop);