media: platform: mtk-mdp3: add pointer checks and use devm_kfree

Fix two errors reported by smatch:
    drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c:292
        mdp_probe() error: we previously assumed 'mdp' could be null
    drivers/media/platform/mediatek/mdp3/mtk-mdp3-cmdq.c:460
        mdp_cmdq_send() error: we previously assumed 'cmd' could be null

Also, avoid warnings reported by smatch:
    drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c:872
        mdp_comp_create() warn: passing devm_ allocated variable to kfree. 'comp'

[hverkuil: fix devm_kfree call]
Signed-off-by: Moudy Ho <moudy.ho@mediatek.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

drivers/media/platform/mediatek/mdp3/mtk-mdp3-cmdq.c

@@ -457,7 +457,7 @@ int mdp_cmdq_send(struct mdp_dev *mdp, struct mdp_cmdq_param *param)
 	kfree(path);
 	atomic_dec(&mdp->job_count);
 	wake_up(&mdp->callback_wq);
-	if (cmd->pkt.buf_size > 0)
+	if (cmd && cmd->pkt.buf_size > 0)
 		mdp_cmdq_pkt_destroy(&cmd->pkt);
 	kfree(comps);
 	kfree(cmd);

drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c

@@ -869,7 +869,7 @@ static struct mdp_comp *mdp_comp_create(struct mdp_dev *mdp,
 
 	ret = mdp_comp_init(mdp, node, comp, id);
 	if (ret) {
-		kfree(comp);
+		devm_kfree(dev, comp);
 		return ERR_PTR(ret);
 	}
 	mdp->comp[id] = comp;

drivers/media/platform/mediatek/mdp3/mtk-mdp3-core.c

@@ -289,7 +289,8 @@ static int mdp_probe(struct platform_device *pdev)
 	mdp_comp_destroy(mdp);
 err_return:
 	for (i = 0; i < MDP_PIPE_MAX; i++)
-		mtk_mutex_put(mdp->mdp_mutex[i]);
+		if (mdp)
+			mtk_mutex_put(mdp->mdp_mutex[i]);
 	kfree(mdp);
 	dev_dbg(dev, "Errno %d\n", ret);
 	return ret;