drm/panel: tdo-tl070wsh30: Remove panel on attach failure

tdo_tl070wsh30_panel_add() calls drm_panel_add() to link the panel into the global panel_list before tdo_tl070wsh30_panel_probe() calls mipi_dsi_attach(). The panel object itself is allocated with devm_drm_panel_alloc(), which only arranges for an automatic drm_panel_put() (via devm_add_action_or_reset()) when the DSI device is torn down; unlike devm_drm_panel_add(), it does not call drm_panel_remove() for you.

If mipi_dsi_attach() fails, probe() returns the error directly:

	return mipi_dsi_attach(dsi);

Once probe() returns an error, the driver core releases devres resources for the device, which drops the allocation's own reference. But drm_panel_add() had already taken its own reference and linked panel->list into the global panel_list, and nothing undoes that. The panel is left registered in panel_list pointing at a device that failed to bind, where it can still be found and dereferenced by later lookups/iterations such as of_drm_find_panel() or find_panel_by_fwnode().

Call drm_panel_remove() when mipi_dsi_attach() fails, mirroring what tdo_tl070wsh30_panel_remove() already does on the normal teardown path, and matching the pattern used by other MIPI-DSI panel drivers that pair a manual drm_panel_add() with mipi_dsi_attach().

---
 drivers/gpu/drm/panel/panel-tdo-tl070wsh30.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

index fa961abdd2d7..32f2dd2bcee7 100644
@@ -179,7 +179,11 @@ static int tdo_tl070wsh30_panel_probe(struct mipi_dsi_device *dsi)
 	if (err < 0)
 		return err;
 
-	return mipi_dsi_attach(dsi);
+	err = mipi_dsi_attach(dsi);
+	if (err < 0)
+		drm_panel_remove(&tdo_tl070wsh30->base);
+
+	return err;
 }
 
 static void tdo_tl070wsh30_panel_remove(struct mipi_dsi_device *dsi)

2.55.0