From nobody Mon Jun 8 06:38:01 2026 Received: from mail-yw1-f173.google.com (mail-yw1-f173.google.com [209.85.128.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BA2B7376481 for ; Mon, 1 Jun 2026 12:22:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780316564; cv=none; b=lKn7qwkYqmSF9yNDmvJzPG6dUqDJXlpFEpwLkgYbk8QzL3SY9hXNfWZvm8K7m+NqlSM0yRHKZHvvLPIp5maw31NiE/cx+li+y63ML4YxL/NNjVDN3KB8jWBFOb9kijnGfRZSRhRQQ6yQa4uU+UdnCA0HsXUpHT39JbP4DXJHJ2s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780316564; c=relaxed/simple; bh=raxceTIYuzE2TeLoQi6O1en5aSarMpH53lH056hoLZU=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=iWPiyijOBwIFBqBKRBgVe8iGRF1fLFT04u1z+RvVevrJYX6HaoAbmTh+43brYg/iYb3VjRxwEpoBkB6i3Dlw/OyJ8yLK1d3LE3+qXBdVL34HTLc/UwulpntKb7ODRrubyKIdRqAvNrElQXCX5Dc8QEnKKtXp4JzklBXpXsCTdxI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=nPij0rd2; arc=none smtp.client-ip=209.85.128.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="nPij0rd2" Received: by mail-yw1-f173.google.com with SMTP id 00721157ae682-7ddd3d67084so38170767b3.3 for ; Mon, 01 Jun 2026 05:22:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780316563; x=1780921363; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to; bh=X+CXfiZafGcocIFXV4Xc1RLvbSqjNNLEx0Fi1Oy/0mQ=; b=nPij0rd2jyy8fW++G3QzmEg0+8Y3BJ0tPD0WWPP8cD5Q/PaRZtfCbkKVxTSPwr+AlC EU9OSvmcCr7NyQEWGHWSGyekHYGqOw1FaVbbSe+zZl3arrRFAUmzBiYnIUKIBWLN+wuc J7qHxCq1TdsArWAUf5AMTZGc7jIqtIWo9ZbWABo0guPqjSG3QfDUvYEqBO2jC19uY1Sq jCOExqU1sb6isdsJmXIYbmXpMuFKQ/MAo3l5CossWXt/D69FKCeM9tMX3Wk+axuhwc95 TLAeeSpHPKHF2h+1zxPuvayDuvAKodOZmpsxJEKGNbYt3UddTRNnSYJ6rapXttoEoB2p 0fMg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780316563; x=1780921363; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=X+CXfiZafGcocIFXV4Xc1RLvbSqjNNLEx0Fi1Oy/0mQ=; b=dCGHWsn972tlRu83d0jFCAzcvQOaM+04anBKVac7VTrBCC0FCCnNaXEBy6+3bB3cZH +QbfSiih9d8ni2ML5FXCNKnjE1UDi6lWXBRiX6Tv14i/x6C8s/X8qKs+C7Aw6E1W/kpD l6PWwHIHPa/6rrkTAI5exM1A5ZcHLOX9lE5f4bNa1o/zzd/sGuK8gIKC/fmYgluUWY+M izVDGkPtvbcEkKV6boxRfBiEDFtjgoEBgFt5HVwhQW9SFH6F4BNqNfYD2vI1+jok2Hh9 C5WuUVVAJAwqXZuSfwBmbKwaE++Mu9g4gj8yz2oSPeIFQgbVI8fXMeEMjXOR/Vl0sGcS sTUA== X-Forwarded-Encrypted: i=1; AFNElJ/Kl9vmD8awgPBJ13BxvdmBdal1RVrWZEBJ3jDOgMhxl5JC8n8JvuUF+cBGB8xwRw2Q2245WBx1bAmpJkM=@vger.kernel.org X-Gm-Message-State: AOJu0YxoQ1l3ZbWV44fJ51aH1Bm3INf9UoC54i6j4fJclvBRQJ30RJlQ 0CruyQ7/5E1wdEvzSrFtNJSKBBNlEyluX3JJCsOWtbtffwo1qD8WljLl X-Gm-Gg: Acq92OEwZedm5x93YS26COfWJim26ASIT6sIaINMJ9cid7cVGA3KyfgvncWnwcrjLm8 2X10kdIgFui42ayYCHNF82RH7ZV33VXdEA4RI/0koixSWx5cH2Uc+ZbOQv95oqpOkVYUSnjOdWl F3vxHwzOiI8lC+0ddS9XrDwdQrA2O74DGxSdtewxb/zcOw3D1FQSz1eKzIYXYIqQVneYFO/gwBd JXTenyRCOYss+yu4vLmaafmIgIuHfSvMN9JN2KXHL0C5d5KhOqizHqKoz0qgdS4VFwuTjFpQgQ5 cXMlIQzEaqd+QZLC0qsy30gcY91Nz/6zo+Nf8YQu2AAc7F/3W/hjIBMxlysHCSvmAUCtwqwKyAC dUgb9OhwHGMH/Q+AWjVuC27i8AJCNqLsc6fEK1+ssW9vA2h9+anxTZU8HDWgIQDROe75pBp/M72 npq+nlE348r6WirgAWBwFh6ew+1dz46DvqydAmgRqmWw== X-Received: by 2002:a05:690c:6a87:b0:7db:f8b1:cd89 with SMTP id 00721157ae682-7e058b3cf8fmr97514447b3.10.1780316562804; Mon, 01 Jun 2026 05:22:42 -0700 (PDT) Received: from lgs.. ([101.76.249.46]) by smtp.gmail.com with ESMTPSA id 00721157ae682-7e17ae7e328sm38856657b3.23.2026.06.01.05.22.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 Jun 2026 05:22:42 -0700 (PDT) From: Guangshuo Li To: Mauro Carvalho Chehab , Jeongjun Park , Kees Cook , Hans Verkuil , Guangshuo Li , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] media: as102: fix memory leak on probe failure Date: Mon, 1 Jun 2026 20:22:15 +0800 Message-ID: <20260601122215.1330897-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" as102_usb_probe() initializes as102_dev->kref and takes a usb_device reference before calling usb_register_dev(). A recent change stopped falling through from failed_stream to failed after usb_register_dev() succeeds, so that as102_dev is not freed while it can still be referenced by an already opened file. However, the new error path deregisters the USB minor and returns without dropping the probe's initial reference. When stream buffer allocation or DVB registration fails after usb_register_dev() succeeds, the initial reference remains held forever. If userspace opens the device in the short window before the failure path runs, close() only drops the open reference and the initial reference still remains. As a result, as102_dev and the usb_device reference held by it are leaked. Drop the initial reference with kref_put() after usb_deregister_dev(). Also use the same kref release path for the usb_register_dev() failure case instead of open-coding usb_put_dev() and kfree(). Fixes: 8bd29dbe03fc ("media: as102: fix to not free memory after the device= is registered in as102_usb_probe()") Signed-off-by: Guangshuo Li --- drivers/media/usb/as102/as102_usb_drv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/usb/as102/as102_usb_drv.c b/drivers/media/usb/as= 102/as102_usb_drv.c index a11024451ceb..dfe5a6b3f97b 100644 --- a/drivers/media/usb/as102/as102_usb_drv.c +++ b/drivers/media/usb/as102/as102_usb_drv.c @@ -405,11 +405,11 @@ static int as102_usb_probe(struct usb_interface *intf, failed_stream: usb_set_intfdata(intf, NULL); usb_deregister_dev(intf, &as102_usb_class_driver); + kref_put(&as102_dev->kref, as102_usb_release); return ret; failed: - usb_put_dev(as102_dev->bus_adap.usb_dev); usb_set_intfdata(intf, NULL); - kfree(as102_dev); + kref_put(&as102_dev->kref, as102_usb_release); return ret; } =20 --=20 2.43.0