gspca keeps a pointer to the probed struct usb_device in
gspca_dev->dev, but it does not hold a reference to it. The
V4L2/video-device reference can keep the outer gspca_dev alive after USB
disconnect, and the streaming queue can then be canceled from the last
file release path.

That late release path still calls into gspca_stream_off(), which may
call sub-driver stop callbacks or usb_set_interface() and dereference
gspca_dev->dev after the USB core has freed the device.

Take a reference to the usb_device when storing it in gspca_dev and drop
it from the final gspca_release() path. Balance the reference in the
probe error path as well.

Fixes: 63eb9546dcb5 ("V4L/DVB (8152): Initial release of gspca with only one driver.")
Cc: stable@vger.kernel.org
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
---
 drivers/media/usb/gspca/gspca.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspca.c
index 594d73e50b9f..59eb4cec1aed 100644
--- a/drivers/media/usb/gspca/gspca.c
+++ b/drivers/media/usb/gspca/gspca.c
@@ -1178,6 +1178,7 @@ static void gspca_release(struct v4l2_device *v4l2_device)
 	v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler);
 	v4l2_device_unregister(&gspca_dev->v4l2_dev);
 	kfree(gspca_dev->usb_buf);
+	usb_put_dev(gspca_dev->dev);
 	kfree(gspca_dev);
 }
 
@@ -1462,7 +1463,7 @@ int gspca_dev_probe2(struct usb_interface *intf,
 		ret = -ENOMEM;
 		goto out;
 	}
-	gspca_dev->dev = dev;
+	gspca_dev->dev = usb_get_dev(dev);
 	gspca_dev->iface = intf->cur_altsetting->desc.bInterfaceNumber;
 	gspca_dev->xfer_ep = -1;
 
@@ -1574,6 +1575,7 @@ int gspca_dev_probe2(struct usb_interface *intf,
 	if (sd_desc->probe_error)
 		sd_desc->probe_error(gspca_dev);
 	kfree(gspca_dev->usb_buf);
+	usb_put_dev(gspca_dev->dev);
 	kfree(gspca_dev);
 	return ret;
 }
-- 
2.43.0