When a sensor is bound, its source pad is retrieved in the .bound() operation with a call to media_entity_get_fwnode_pad(). The function should be called with the source endpoint fwnode of the sensor, but is instead called with the sensor's device fwnode. Fix this, which involves storing a reference to the source endpoint fwnode in the rkisp1_sensor_async structure, and thus implementing the subdev notifier .destroy() operation to release the reference. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Reviewed-by: Paul Elder <paul.elder@ideasonboard.com> Reviewed-by: Dafna Hirschfeld <dafna@fastmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>