From nobody Fri Apr 17 21:54:35 2026 Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6A093239594 for ; Fri, 13 Feb 2026 13:46:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.50 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770990389; cv=none; b=Soix9QSg27/5OeVtYBHGaDNmzBsefRmZO0LPY5elD6vk64OR+RN6ozs0QC2VzsRdpurYceFg4gH/IFVfnqBoR3GFFqo/KSKhEDC9FyF3W+ccYcE0mSSkEJrGcQlw5YGZFGEJN9hMD4MC9PUs73xOudvBYnKqndG0gX9+fULX6Dw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770990389; c=relaxed/simple; bh=ga/898w/rBkOI5h+0CfCijMC5AU1ZBzwNHy+DuGX48U=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=FSsnWkT0myvA1UAJUDJ4QzfDhF//2r27VxP6xTi0lHIUz+ha+5VL+riY6/j9XMhQi1zlx1AAEJY+reLvvMKvOKqgVHxojK9AcBKVwnrP3loLpJnZ1e7qI3+8rJ7bjfOxTuW5LzjlJRqVDlIWEFRe9+F22JKCY5tn4WNPGMVTM2s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=suse.com; spf=pass smtp.mailfrom=suse.com; dkim=pass (2048-bit key) header.d=suse.com header.i=@suse.com header.b=ZpyFuGPZ; arc=none smtp.client-ip=209.85.128.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=suse.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=suse.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=suse.com header.i=@suse.com header.b="ZpyFuGPZ" Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-48373a4bca3so3292295e9.0 for ; Fri, 13 Feb 2026 05:46:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=google; t=1770990387; x=1771595187; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=z3kT6gzFtavn2g25Q3ZqjtMQzhhOeb/nLljiXXqhXNo=; b=ZpyFuGPZFiLFkkDDiACSvGYan3Q0sf5XU3nmMElb8zgp59PF2oMkvRtSV2CuNf4weu aZWvBtMbYAdfskmqSJCFmFAknYqmAnjwzTciJ+CrEexzJiIyfbQfdvj6KueIcuy50PjQ awvihJl3c+d7y6A+cTieouSSJIJQTnUjLvlJYSHWSBvshbyXrcxPmt33FxzLI3s64Ozn 8ay1oVMuvaC/9MOOI2+OFG81mKda7QbLz9sZ9ekMAymNTGNIXuR0LvbYzSW434VfcpMV 92UW3qBfGIO9nj/daIQBdMXk36VATlnpwJGvt0enqjg8w24Gk1SpuhQcxZNgHBLLCQuC TZRQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770990387; x=1771595187; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=z3kT6gzFtavn2g25Q3ZqjtMQzhhOeb/nLljiXXqhXNo=; b=d4gPLNb8/Mtx22mTYBiBH4WVDfGnw9k0vN79SHHUMGOrQWfGqfM++F3tl7q3EMyWU1 OR5oKoY1VpGWghmSvhV6Eff5qadxOuOPZHxbjEtUNW8kV9iFaQLuB6FqHbgP/DXiEcUy Ubab/OWH422K09T98m/LqCqnhZ/QrIgAkmc4myqedApwihvkKlXzhKLREmos2if8dwB8 wLcOXLoMIIToxHbvV0mZUaRdGvoJI1ZbdAaFFY4I+V5kNUeJoPfNV8OlqFtocBA5cg48 6BjrdtLir6ElAWpeC40DYF2K7Cnsig6L1KcqYTlB5GoitheVhiEth8181d3EO0DriUg5 7PRg== X-Forwarded-Encrypted: i=1; AJvYcCWAM7XI9X2aDHwShs0D2ksd1CqsXt7dNIIsXFsORFjGeu31k24e6hQw8FWEAKs8aGjzu0q0a4m0EEpHmws=@vger.kernel.org X-Gm-Message-State: AOJu0Yyd1iA/TRjCVCIBGoVHg6s/Dk5/ApfmKh76LDjIOkBf1cT3mH1e DPZXf+QFqTAsMUFPZAAlGnx+ZTpW5auiQ8JCmAQ0OrUSOuKZV0qkH+BnokJCqwwLQtA= X-Gm-Gg: AZuq6aIwT+UcHxqtMay/EjshSw6uYBBN5cQuaPLSEQtpdMPqOFJrMfmt0bHOWqz1Mwc zD32881+W6ZlBliOLHuNKcUo8njdlVdF8RgKFA9TzK+9cIQZi4zRjlssqJ3IlTM8oZMhA5bNZ7j hsFY+YI0AxZbMHFH7zdiZRoA+j3fqrkvatrvIZsnruvhwSZzqoOBnxPNXLQyx484Z1LRnwsyb61 uV4uIK5tm03Ei3C2/F3PiIIkGXDGXXH8l7R5t/8CrJ2fgWv1eSQ+hcCzLPe1fq07ePh9Nahwa58 Y14jpvFVeD+f3KL0V8aitl5mRVHBDQb3Ilj83TtfDUs/RHcnWo4pzfvA8HmJLqLlHFBQIapssIR C0SfWxoGxKrqcr2SR2dCePcDWdawjg7i4EcgTWiSdM26lmr2hhH82D8sgvCV3PNXwNMsHcc4jU7 AslmARj+8KsVZ04l7f3pxoFl50myOGE6nzfdSV5Q7Q X-Received: by 2002:a05:600c:4746:b0:471:114e:5894 with SMTP id 5b1f17b1804b1-48373a565d0mr32339115e9.25.1770990386718; Fri, 13 Feb 2026 05:46:26 -0800 (PST) Received: from zovi.suse.cz (nat2.prg.suse.com. [195.250.132.146]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48371a2998fsm17198625e9.17.2026.02.13.05.46.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 13 Feb 2026 05:46:26 -0800 (PST) From: Petr Pavlu To: Mauro Carvalho Chehab Cc: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Petr Pavlu , syzbot+e993e01b15c8eefd9cd4@syzkaller.appspotmail.com Subject: [PATCH 1/2] media: dvbdev: Prevent a dangling pointer in dvb_minors Date: Fri, 13 Feb 2026 14:44:15 +0100 Message-ID: <20260213134551.1294954-2-petr.pavlu@suse.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260213134551.1294954-1-petr.pavlu@suse.com> References: <20260213134551.1294954-1-petr.pavlu@suse.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Syzbot reports a slab-out-of-bounds write in try_module_get(): =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BUG: KASAN: slab-out-of-bounds in instrument_atomic_read_write include/linu= x/instrumented.h:96 [inline] BUG: KASAN: slab-out-of-bounds in atomic_inc_not_zero include/linux/atomic/= atomic-instrumented.h:1536 [inline] BUG: KASAN: slab-out-of-bounds in try_module_get+0x46/0xc0 kernel/module/ma= in.c:913 Write of size 4 at addr ffff888142f67108 by task syz.3.2706/18556 CPU: 1 UID: 0 PID: 18556 Comm: syz.3.2706 Tainted: G L syz= kaller #0 PREEMPT(full)- Tainted: [L]=3DSOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xba/0x230 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_inc_not_zero include/linux/atomic/atomic-instrumented.h:1536 [inlin= e] try_module_get+0x46/0xc0 kernel/module/main.c:913 dvb_device_open+0xef/0x350 drivers/media/dvb-core/dvbdev.c:103 chrdev_open+0x4cd/0x5e0 fs/char_dev.c:414 do_dentry_open+0x7ce/0x1420 fs/open.c:962 vfs_open+0x3b/0x340 fs/open.c:1094 do_open fs/namei.c:4637 [inline] path_openat+0x3486/0x3e20 fs/namei.c:4796 do_filp_open+0x22d/0x490 fs/namei.c:4823 do_sys_openat2+0x12f/0x220 fs/open.c:1430 do_sys_open fs/open.c:1436 [inline] __do_sys_openat fs/open.c:1452 [inline] __se_sys_openat fs/open.c:1447 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1447 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7feefad5b78e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d = 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 8= 4 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007feefbc79b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007feefbc7a6c0 RCX: 00007feefad5b78e RDX: 0000000000000002 RSI: 00007feefbc79c00 RDI: ffffffffffffff9c RBP: 00007feefbc79c00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007feefb016128 R14: 00007feefb016090 R15: 00007ffc341cef58 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The dvb_device_open() function performs 'dvbdev =3D dvb_minors[minor]' and then calls fops_get(dvbdev->fops). The code in fops_get() invokes try_module_get(fops->owner) but this operation fails because the module is apparently gone. The issue seems to stem from dvb_register_device() which assigns dvb_minors[minor] and then continues with the device creation. However, if a subsequent step fails, the value in dvb_minors[minor] is not cleared, leaving a dangling dvbdev pointer in the array. Fix the issue by extending the duration for which minor_rwsem is held in dvb_register_device() and assign dvb_minors[minor] only after the device creation is fully completed. This is similar to the approach taken in usb_register_dev(), where usb_minors and its minor_rwsem are handled. Reported-by: syzbot+e993e01b15c8eefd9cd4@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3D71d5d861d9adc6905054 Fixes: 5dd3f3071070 ("V4L/DVB (9361): Dynamic DVB minor allocation") Signed-off-by: Petr Pavlu --- drivers/media/dvb-core/dvbdev.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbde= v.c index 8b980d371a45..c067bbeb9461 100644 --- a/drivers/media/dvb-core/dvbdev.c +++ b/drivers/media/dvb-core/dvbdev.c @@ -548,8 +548,7 @@ int dvb_register_device(struct dvb_adapter *adap, struc= t dvb_device **pdvbdev, } =20 dvbdev->minor =3D minor; - dvb_minors[minor] =3D dvb_device_get(dvbdev); - up_write(&minor_rwsem); + ret =3D dvb_register_media_device(dvbdev, type, minor, demux_sink_pads); if (ret) { pr_err("%s: dvb_register_media_device failed to create the mediagraph\n", @@ -563,6 +562,7 @@ int dvb_register_device(struct dvb_adapter *adap, struc= t dvb_device **pdvbdev, list_del(&dvbdev->list_head); kfree(dvbdev); *pdvbdev =3D NULL; + up_write(&minor_rwsem); mutex_unlock(&dvbdev_register_lock); return ret; } @@ -582,10 +582,14 @@ int dvb_register_device(struct dvb_adapter *adap, str= uct dvb_device **pdvbdev, list_del(&dvbdev->list_head); kfree(dvbdev); *pdvbdev =3D NULL; + up_write(&minor_rwsem); mutex_unlock(&dvbdev_register_lock); return PTR_ERR(clsdev); } =20 + dvb_minors[minor] =3D dvb_device_get(dvbdev); + up_write(&minor_rwsem); + dprintk("DVB: register adapter%d/%s%d @ minor: %i (0x%02x)\n", adap->num, dnames[type], id, minor, minor); =20 --=20 2.52.0 From nobody Fri Apr 17 21:54:35 2026 Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4C2FA344DBA for ; Fri, 13 Feb 2026 13:46:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.47 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770990390; cv=none; b=d1Qh6ECcjzUD5CW3plSHEdYCEk41/I5xrtZ1z5UMmfalQXHH/AbfPXVTGcNH9JLeFHrUmXHow9X4FOUAZ78FxAGIFZSXlGgn/u3/99uiQhwheq+g03gOlNhbjK7QqFDFluNoeP22vHrHXZbbBXf5z3jQlkLyaHUTEAuIH9V2w/Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770990390; c=relaxed/simple; bh=7uzhT1Hdpq2Zj/z3tC0kx0DO7eu7YJpM8NOGHA2+aEU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=PZXtKtGs8LEL18y4T8U8+5MN4qQgkNIJ9iV1mppY873c2AbuHWIfRiZgxcFCDG1fPErSOAXGiRl5LEzSLEGoRCSSFDCu9MLMEdCBeOgY3Isol5rTYE8qKPPqpp07UEykb4V0ubJBOxF1QFIzPD6nl2lOYFqQhSID6XdwvWVyvOs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=suse.com; spf=pass smtp.mailfrom=suse.com; dkim=pass (2048-bit key) header.d=suse.com header.i=@suse.com header.b=b8Ks7bQv; arc=none smtp.client-ip=209.85.128.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=suse.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=suse.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=suse.com header.i=@suse.com header.b="b8Ks7bQv" Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-4836d4c26d3so7578505e9.2 for ; Fri, 13 Feb 2026 05:46:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=google; t=1770990388; x=1771595188; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=4B97dcFXXQx/22amrzajNB5xqYOGdgqYpxZ5xW5NAyU=; b=b8Ks7bQvyUkk2F2wlPNJKzjRKifHGmZFZYQ3Cf2KK455nlodcZ5T5TXTDIgM2+9usS ds7HW2p0a6k1S54MzhCAvMUh64t1EpOP+xyYm3Saz5pjm+vsEotoLemSLcch6DU4aPWR Y+PCmtCq5eedV7tSaTn3CkR20z3i0o6C0SvCdd48vBQDiekbOrwY4teDX81p/45flYuj 2q3RSIW5xbZbA6tHYeML/47+5MUToYRYy5YuWGJvyywjnojw4/xcUWEUJL5y9x0+EgSg SfZGg+PcjPMtrbMV1R+EpqmE0WaVUsczU4roNNRPrenSfPILfkVW6T/FtRQPnVSN6Cov /2uA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770990388; x=1771595188; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=4B97dcFXXQx/22amrzajNB5xqYOGdgqYpxZ5xW5NAyU=; b=gD6T/7/7voqPY5JVI7FQWMVPMJepwXMDQ1xEmOzFPr4NK6SQya1JDbVywLArbp/guH /eHefQhIi+X2rR8HC/8XE3qHZ18Y/bybxb9P92XDuecUx3IkvV+bSA/Ey4WE6NwvPrje 6yvnGMReUMWGuNmCBRt2/U8KwzaBViFqnYsfmX+mp6YSISP8wCd/Y7G7XnHO7ODP0NTt Ieamq0Bl6GSCI8do0cKi4thdPI20NzBQ3TQeVBYA3dlwD6M2Xoz6oRPrq2fMlJpFJ6vt Zl967MVjRkosSg7EUQgGoqvX2Ct9AqlkIfbZV+iCqhi4odULw961+rRKX9CumrzKFzAV nQgA== X-Forwarded-Encrypted: i=1; AJvYcCXmV1v+0GJbApowFL7cNFk0QT2I6ZOnFaCHd6XVHCXbX9oZKVMnsbxNES8zgCgYYSSKPpxeO+yIXgmie0M=@vger.kernel.org X-Gm-Message-State: AOJu0Yxp0K0ksUDnG1ol8C5fLfHhsIEds++lkqOBsyzzzLAeY0bNnRXY SOQ79Pp3GNk4q2iuIVumsKkoANBLERZ7XGxYoWzcmoDe1wESflDd1PnzJ1LKZ4wXyvU= X-Gm-Gg: AZuq6aJvSrNKxQu9YkvbmtqLDaa9K6MZaRPuY+tm7jkjFVnVRDzwnyo7I/j+DKvfovF Y5+MvgOTvMlajGfPDrIC3d/T/uM+gDjIpMBt7V8y4LcDymLrF9A/HAbonDzGWQWUD/14eqLUtzS mjd+8ItCKgZXt2qa45bUg7wh0kUfRwDaffj4Bov7ecapGH/VF8Q2bDLQCkCtf+na++55flH0uVm 36UeAjwIkJsDdDzB3A3zXBAWWHkOlNKLe54cjH5F8v71/tAOQB8GWuwnFqPp2TrGMFJErUFL5oF y5wwDTwygrdg4vL9nCsrWSlOIPiAiDH5iZmhS4ykP1wFalwRTEwhDkBdJeavYuYNVcpSwZ7x3LI 5V21TOIVjpgQPoR39N+EnNRMcyA4slflNUqhpFheiCyArKP6RBKDeH8DHBIZvNsrLYrv+4aQ7Oz UNmMeBzsBcO0P2ExVgExOZWMIKwGJjLa8EF9blXEaD X-Received: by 2002:a05:600c:314f:b0:483:6fe1:c057 with SMTP id 5b1f17b1804b1-48373a3f3bcmr26871935e9.21.1770990387410; Fri, 13 Feb 2026 05:46:27 -0800 (PST) Received: from zovi.suse.cz (nat2.prg.suse.com. [195.250.132.146]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48371a2998fsm17198625e9.17.2026.02.13.05.46.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 13 Feb 2026 05:46:27 -0800 (PST) From: Petr Pavlu To: Mauro Carvalho Chehab Cc: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Petr Pavlu Subject: [PATCH 2/2] media: dvbdev: Simplify error paths in dvb_register_device() Date: Fri, 13 Feb 2026 14:44:16 +0100 Message-ID: <20260213134551.1294954-3-petr.pavlu@suse.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260213134551.1294954-1-petr.pavlu@suse.com> References: <20260213134551.1294954-1-petr.pavlu@suse.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The error paths in dvb_register_device() each handle necessary cleanup operations individually. Since the function performs a number of operations, this leads to duplicated and lengthy code. Unify the cleanup process under error labels. Signed-off-by: Petr Pavlu --- drivers/media/dvb-core/dvbdev.c | 79 +++++++++++++-------------------- 1 file changed, 31 insertions(+), 48 deletions(-) diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbde= v.c index c067bbeb9461..94591f8a7afa 100644 --- a/drivers/media/dvb-core/dvbdev.c +++ b/drivers/media/dvb-core/dvbdev.c @@ -466,16 +466,15 @@ int dvb_register_device(struct dvb_adapter *adap, str= uct dvb_device **pdvbdev, =20 id =3D dvbdev_get_free_id(adap, type); if (id < 0) { - mutex_unlock(&dvbdev_register_lock); - *pdvbdev =3D NULL; pr_err("%s: couldn't find free device id\n", __func__); - return -ENFILE; + ret =3D -ENFILE; + goto error_set_pdvbdev; } =20 *pdvbdev =3D dvbdev =3D kzalloc(sizeof(*dvbdev), GFP_KERNEL); if (!dvbdev) { - mutex_unlock(&dvbdev_register_lock); - return -ENOMEM; + ret =3D -ENOMEM; + goto error_unlock; } =20 /* @@ -494,19 +493,15 @@ int dvb_register_device(struct dvb_adapter *adap, str= uct dvb_device **pdvbdev, if (!dvbdevfops) { dvbdevfops =3D kmemdup(template->fops, sizeof(*dvbdevfops), GFP_KERNEL); if (!dvbdevfops) { - kfree(dvbdev); - *pdvbdev =3D NULL; - mutex_unlock(&dvbdev_register_lock); - return -ENOMEM; + ret =3D -ENOMEM; + goto error_free_dvbdev; } =20 new_node =3D kzalloc(sizeof(*new_node), GFP_KERNEL); if (!new_node) { kfree(dvbdevfops); - kfree(dvbdev); - *pdvbdev =3D NULL; - mutex_unlock(&dvbdev_register_lock); - return -ENOMEM; + ret =3D -ENOMEM; + goto error_free_dvbdev; } =20 new_node->fops =3D dvbdevfops; @@ -534,17 +529,8 @@ int dvb_register_device(struct dvb_adapter *adap, stru= ct dvb_device **pdvbdev, minor =3D nums2minor(adap->num, type, id); #endif if (minor >=3D MAX_DVB_MINORS) { - if (new_node) { - list_del(&new_node->list_head); - kfree(dvbdevfops); - kfree(new_node); - } - list_del(&dvbdev->list_head); - kfree(dvbdev); - *pdvbdev =3D NULL; - up_write(&minor_rwsem); - mutex_unlock(&dvbdev_register_lock); - return -EINVAL; + ret =3D -EINVAL; + goto error_dvbdev_cleanup; } =20 dvbdev->minor =3D minor; @@ -553,18 +539,7 @@ int dvb_register_device(struct dvb_adapter *adap, stru= ct dvb_device **pdvbdev, if (ret) { pr_err("%s: dvb_register_media_device failed to create the mediagraph\n", __func__); - if (new_node) { - list_del(&new_node->list_head); - kfree(dvbdevfops); - kfree(new_node); - } - dvb_media_device_free(dvbdev); - list_del(&dvbdev->list_head); - kfree(dvbdev); - *pdvbdev =3D NULL; - up_write(&minor_rwsem); - mutex_unlock(&dvbdev_register_lock); - return ret; + goto error_free_media; } =20 clsdev =3D device_create(dvb_class, adap->device, @@ -573,18 +548,8 @@ int dvb_register_device(struct dvb_adapter *adap, stru= ct dvb_device **pdvbdev, if (IS_ERR(clsdev)) { pr_err("%s: failed to create device dvb%d.%s%d (%pe)\n", __func__, adap->num, dnames[type], id, clsdev); - if (new_node) { - list_del(&new_node->list_head); - kfree(dvbdevfops); - kfree(new_node); - } - dvb_media_device_free(dvbdev); - list_del(&dvbdev->list_head); - kfree(dvbdev); - *pdvbdev =3D NULL; - up_write(&minor_rwsem); - mutex_unlock(&dvbdev_register_lock); - return PTR_ERR(clsdev); + ret =3D PTR_ERR(clsdev); + goto error_free_media; } =20 dvb_minors[minor] =3D dvb_device_get(dvbdev); @@ -595,6 +560,24 @@ int dvb_register_device(struct dvb_adapter *adap, stru= ct dvb_device **pdvbdev, =20 mutex_unlock(&dvbdev_register_lock); return 0; + +error_free_media: + dvb_media_device_free(dvbdev); +error_dvbdev_cleanup: + if (new_node) { + list_del(&new_node->list_head); + kfree(dvbdevfops); + kfree(new_node); + } + list_del(&dvbdev->list_head); + up_write(&minor_rwsem); +error_free_dvbdev: + kfree(dvbdev); +error_set_pdvbdev: + *pdvbdev =3D NULL; +error_unlock: + mutex_unlock(&dvbdev_register_lock); + return ret; } EXPORT_SYMBOL(dvb_register_device); =20 --=20 2.52.0