From nobody Sat Jul 25 19:29:02 2026 Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C0E054BC02D for ; Tue, 14 Jul 2026 15:17:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784042233; cv=none; b=j0R6L4p55O99qGohYi8GL5t/D7Vy/nm4vxgsm403hxfp4sL7b95M56CjrEsLZdJfkVRb7BqIi85K/H6d00vn2Zr3oNs1GBTuDgPfictgOTtbCQ2mKHM4K7vVvfy3rhozYuoN3UA/lPpxn1yrGNhifFjCwbWPGkGiEYu51xnTGDw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784042233; c=relaxed/simple; bh=qvhInT/SgcuGyP/ork55nnSJpC2mxeW1HjGP20C6WSM=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=YFm/2fIbIPgVKVE+3msReEAyw0HZVRONJ7yXKX+pov1hQ8H5AzJmalfP/aY6eqXyvTkYJS17HqhR6V+N96HoFTrI9InW29wAvWzjX574MkaT02Pr9NEik6qg/6LsrapNPhLZ3ZLrFup6vM0v5myIj8iIvnyLQif7JELYpIy5NyY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=m6uRfOwM; arc=none smtp.client-ip=209.85.214.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="m6uRfOwM" Received: by mail-pl1-f173.google.com with SMTP id d9443c01a7336-2c6b67d5fa1so73947075ad.2 for ; Tue, 14 Jul 2026 08:17:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784042231; x=1784647031; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=joYU7SNNWgacv3mwvw+01Lka//SvlR+4VPR0uOgRcXA=; b=m6uRfOwMwwqO6OqQ1QAXW3oNIeNE7f8ckkX4ncMbFIpNzHMJPc7jnLzTX7oK7ArYqq tWqPRM74fokn+3JKrsEhf13xmau7vu8LF/hMS903BV+CLxpgkKQ8VYQnl9fpOl23vO1B RT7LrOtFB26+hmxXEl4fs+Q94IWeHG9UVdhtCbC1W7PnyQ3kNbUZp+PK8ETHLvyXDYD1 BqBNyOV8Fl30uya4ncCfjRNG0W1z/jo6yxLIL7hLuOtU+2sYWfR1U5dV+BmJOLQkD5En 9PKjnT+H/6hquJsRS0j2xmtjnfC0uBIgadlvq4b8KaYgIkbGcZPqbE9RoD9RLwTAchma PgVQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784042231; x=1784647031; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=joYU7SNNWgacv3mwvw+01Lka//SvlR+4VPR0uOgRcXA=; b=rrZ2li8UMJbKkpSEONmRqNjlM1v8bZI0uv6bStrzqSci6DA1rZGJx0b3PybHq5Wtvg GgvS5fICyyXOuPZ4K9cAYwDtwX5RsXP/aWbMmH1xv0vm2UrcC3zLck+760mfhpl9ilp2 oCG13EnUNrVFxOj5pwiP3QDUrPbggzdQ1x1pqVFIM3gmNX/Y5ymFeeUMbhhk0efEXke9 CKhczTRIKFcbBEjq0TAQK5J43j6w83hR8ouQ+lqdhNffc/puAYco5SlpDAzYwPaFi0+Q rnAtNUNWfGNTvjVWlt+A7f+vhNu7S8xffNoeCbeeqIkWWQgx2WNUkWSXVHcB2ubUxYtC uwPA== X-Forwarded-Encrypted: i=1; AHgh+Rrpn8UeVdAdKDksCzXm6ZleYFMmCyHNdAqlxucc9XK7Y8Ysl5WYqAAqzkOHxRR6r4FBjZt65SdJNy5ZNQA=@vger.kernel.org X-Gm-Message-State: AOJu0Yzkyd9TNxZSNgdCxruQYc2tkTATTdrxnxsLyyMalsrSPaur0ywI WbwvRg8CDTQydPZRZnUmJexG1WEX+WidXHvlqo2Zq3gDFp6ra1wK1wB9 X-Gm-Gg: AfdE7cm6mdJaSFWK5AbyECGaYPKXZFq61BpGe3ee1HB8Tn9ir8e1s3e3ucjeDQsXrD3 OshRIGmZQosMPEUdt6B1HfwDti75eUQjtJJ7gs4DT3EmliZzW+u0qqGAIxUdgADr33p2bxOGHaV rOYI3rIEei4JKJZPAnuBfe1fHg+gNDuqh7wkDCH+HVzDUPNOG5ZTTPk2vO/Dzi/mNA92399lK+y DL7YOwni6vDAHx/HvCI7s23BjWF+RKACVuQCraZKkmTjwhH8XTumU3YrIG6yfSoB70LZKEO5TA4 8CMQOGIRK0+fkOu5Hi6Bd2Jo8b1Xd57y4MVJHTbd6IVlINj9S1TvrcJ+RP54cwIVwKXfr38yAAD ALCTelVcapTX3XlozleTdQaQbkaN9ED7TAMfm1i9/JBquX8jTTDLkfvbMAkd7yhrFm6XLmHUUpU YlTy/uFZQW6ZSHirc1vNhL X-Received: by 2002:a17:90b:5830:b0:387:e0bb:57f7 with SMTP id 98e67ed59e1d1-38e1af72937mr2984017a91.40.1784042231006; Tue, 14 Jul 2026 08:17:11 -0700 (PDT) Received: from lgs.. ([101.76.249.46]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-38d305ce5d1sm3935600a91.2.2026.07.14.08.17.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jul 2026 08:17:10 -0700 (PDT) From: Guangshuo Li To: Mauro Carvalho Chehab , Johan Hovold , Hans Verkuil , Guangshuo Li , Kees Cook , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] media: usbtv: Fix V4L2 refcount leak on probe failure Date: Tue, 14 Jul 2026 23:16:48 +0800 Message-ID: <20260714151648.1724134-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" usbtv_probe() allocates usbtv before usbtv_video_init() registers its embedded v4l2_device. v4l2_device_register() initializes the reference count to one, with usbtv_release() providing the final cleanup. If video_register_device() fails, usbtv_video_init() unregisters the V4L2 device and returns an error without dropping the initial v4l2_device reference. The probe error path then calls kfree() on usbtv directly, leaving the reference stranded and bypassing usbtv_release(). Leave the initialized V4L2 device intact on this failure path. After releasing the USB reference, call v4l2_device_put() so the final reference invokes usbtv_release(). Retain the direct kfree() path for failures that occur before v4l2_device_register(). This issue was found by a static analysis tool I am developing. Signed-off-by: Guangshuo Li --- drivers/media/usb/usbtv/usbtv-core.c | 5 ++++- drivers/media/usb/usbtv/usbtv-video.c | 4 +--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/media/usb/usbtv/usbtv-core.c b/drivers/media/usb/usbtv= /usbtv-core.c index 6c4facf4f41a..4f10f6613bc4 100644 --- a/drivers/media/usb/usbtv/usbtv-core.c +++ b/drivers/media/usb/usbtv/usbtv-core.c @@ -119,7 +119,10 @@ static int usbtv_probe(struct usb_interface *intf, =20 usbtv_video_fail: usb_set_intfdata(intf, NULL); - kfree(usbtv); + if (usbtv->v4l2_dev.dev) + v4l2_device_put(&usbtv->v4l2_dev); + else + kfree(usbtv); =20 return ret; } diff --git a/drivers/media/usb/usbtv/usbtv-video.c b/drivers/media/usb/usbt= v/usbtv-video.c index de0328100a60..92bc7a2509c3 100644 --- a/drivers/media/usb/usbtv/usbtv-video.c +++ b/drivers/media/usb/usbtv/usbtv-video.c @@ -949,13 +949,11 @@ int usbtv_video_init(struct usbtv *usbtv) ret =3D video_register_device(&usbtv->vdev, VFL_TYPE_VIDEO, -1); if (ret < 0) { dev_warn(usbtv->dev, "Could not register video device\n"); - goto vdev_fail; + return ret; } =20 return 0; =20 -vdev_fail: - v4l2_device_unregister(&usbtv->v4l2_dev); v4l2_fail: ctrl_fail: v4l2_ctrl_handler_free(&usbtv->ctrl); --=20 2.43.0