In the Linux kernel, the following vulnerability has been resolved:

media: atomisp: gc2235: fix UAF and memory leak

gc2235 probe() handles its error paths incorrectly.

If media entity pads init() fails, gc2235 remove() is called, which tears down the subdev and frees dev, but then still falls through to atomisp register i2c module(). This results in use-after-free.

If atomisp register i2c module() fails, the media entity and control handler are left initialized and dev is leaked.

gc2235 remove() unconditionally calls media entity cleanup() and v4l2 ctrl handler free(), but these are not initialized at every error path in gc2235 probe().

Replace gc2235 remove() calls in the probe error paths with explicit unwind labels that free only the resources initialized at each point of failure, in reverse order of initialization.