From nobody Sat Jul 25 04:29:57 2026 Received: from mail-qv1-f46.google.com (mail-qv1-f46.google.com [209.85.219.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 20488271468 for ; Sat, 18 Jul 2026 02:55:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784343314; cv=none; b=r1lXxwCWeoqT9l55Iedqa7TAww59qkAHPK66IzOIVGtcIgdiE6Wl5F1+Wa97+Xk9O0OdmYQvdQJDH+CZ+Jz51njH9W0oboYb33eGE3bCSh2pSY7yx6Z1dMP0N7bNGHg3JJnVb6wZxJe/Uwvx3nuKpk5ymVNJoBi8R2KUTQi92t8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784343314; c=relaxed/simple; bh=Ul0DFw3Ej73eiCwcTexNy8jh0poOMPwPODq7wz9FOLo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=rOb9UjZH+rlWhqurTfZRoKmSA6zJ3CR1mLkvXM/rZTUoDTF2UthXB5gHhqCqsD28ZLhNw76xuduKObybOGn+L1EWipfk+Na93IrbXl+/V+ixDdooWa+DmMZks4Q/O2s3uzwiHJHmiTTf8kIA1Muf8LwMpFKKrOUsnju+2XfWde0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=RvgJ5Vio; arc=none smtp.client-ip=209.85.219.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="RvgJ5Vio" Received: by mail-qv1-f46.google.com with SMTP id 6a1803df08f44-902f92b8504so78995486d6.2 for ; Fri, 17 Jul 2026 19:55:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784343312; x=1784948112; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=47ZO/fVoFhUn5pOP6KZbb4HeOIXd+WNQBMG6RHvVVbs=; b=RvgJ5ViotQLfRJiSoeDnezx0MSxNBQrQhs1y/0aA3Lc4gB4efOA9SsmL9lNInY91Bo BHii1kkunIXszvkFdLmUMdwBqx8feuJNjK7EPwG21Y497bYfH5gKiGgIaZqE9zkr2eoc 3tpU3Oy+CW6yygTJ9+id/LdfSWvC+pde91Y2xFmvw8WBLhgF2pRfSJTuf6ek4i0p7k44 kr5Zv60T5M5OQfbPQEOnDENEryu68zeNh5cn/Tc3Dyxj0wDyDkjisBlII63/jLj5I0h1 Wywvz+L1guefGKMynuFzgj12D4oK1teUgCGDuDM9Ew6AkRl14UX9hDAKKzDfo3XEzUCD 079g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784343312; x=1784948112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=47ZO/fVoFhUn5pOP6KZbb4HeOIXd+WNQBMG6RHvVVbs=; b=PjtRW9BuYF9FSJHEPmj6WPpXI6gFzdSy0NZbTqSTOrRjNh24wzzpRItSQ2xNfS8PNI yCrwU+FgfyquWYMQoWQbTA8gG0KYUFSqbikzsq58pmxeOtFKd4AgQ5LOV83Ot7J+kiWj 2KjcUQ1tsPYRxYR0v7GdT0A7gKA0IVXU9MgD5L9jHK0UicMlqMPE9vYPU/Edhw6S/cDg 8ssF+V8sZnq1uhS7+ejiTq8NvaNI34paB6xmY2AgFlRUaXOMzjD5RXtkzq+8sVFPie5A s+dkVzyrullbKmrRACkqWVenjcELRdqKX0W/7cD/3cYWEBTvll2qGcmarGohKLplkDtn eD8w== X-Forwarded-Encrypted: i=1; AHgh+RpqWORzckafaWr7l5tRxsDc6e17L8quVwqTWqMSpZY4a89Boyto6EInvxiUALFbpMPaT6UyMxktq9bHot4=@vger.kernel.org X-Gm-Message-State: AOJu0YyAfExNAGRszU6SVCVRKgNGndpe6UNwDV73ikwhz+rWSmDXR9I5 AsDDV5lStmaCX18GxPQm2K2I6k5Y359h70YvECQPZhkCNg3WBBI1bkkW X-Gm-Gg: AfdE7ckrQmwig5Rn3SbdnwBRqnc4qQ3czsJBF2Unne5TKah/t1JBL+lR4w9T1SrX2je 68cN2kEDa+ntjEN7vwJdVmGAdZowogVN25aFGteuA7iaSOM5kWvi/GYsV3YewFmGbKD093+JjVO K4utBj7PYWVoBaMRIbLQxyXLi+/jhp44McRwKAb320ToewnO+E7GWiApvVDQoRnvcBhg7onJNTr 0zeiyTc4QVfHNo2hfFWdN/c6JP5cJrcntX567hk7Y02SGdktlG0IlrU4zw/LV5DkMsu6AZLwzTd IE5lkDmYngYQS6tsirZQtRTreMVBiAAbegATw0RY+rR4DghIS5aAmV1kFoG7rTvp21AGj8pKB4/ JsIXpLyL9/dW9kzh5zimV0fDqUWOmSZQDbQ2GemZZ8BrMyCb1eqAxm3cNvuZ6neDLg9eOlZsTs0 aaH3rZKH8Z3TXfQ9d+8olCbPHm07Thl5c= X-Received: by 2002:a05:6214:331b:b0:907:8374:6abb with SMTP id 6a1803df08f44-90783746d93mr18429716d6.59.1784343311874; Fri, 17 Jul 2026 19:55:11 -0700 (PDT) Received: from i4-l-hqh5357-03.ad.psu.edu ([130.203.139.71]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-90778728a50sm31883066d6.47.2026.07.17.19.55.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Jul 2026 19:55:11 -0700 (PDT) From: Shuangpeng Bai To: hverkuil@kernel.org, mchehab@kernel.org Cc: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Shuangpeng Bai Subject: [PATCH] media: gspca: hold a usb_device reference while registered Date: Fri, 17 Jul 2026 22:54:34 -0400 Message-ID: <20260718025434.2259756-1-shuangpeng.kernel@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" gspca keeps a pointer to the probed struct usb_device in gspca_dev->dev, but it does not hold a reference to it. The V4L2/video-device reference can keep the outer gspca_dev alive after USB disconnect, and the streaming queue can then be canceled from the last file release path. That late release path still calls into gspca_stream_off(), which may call sub-driver stop callbacks or usb_set_interface() and dereference gspca_dev->dev after the USB core has freed the device. Take a reference to the usb_device when storing it in gspca_dev and drop it from the final gspca_release() path. Balance the reference in the probe error path as well. Fixes: 63eb9546dcb5 ("V4L/DVB (8152): Initial release of gspca with only on= e driver.") Cc: stable@vger.kernel.org Signed-off-by: Shuangpeng Bai --- drivers/media/usb/gspca/gspca.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspc= a.c index 594d73e50b9f..59eb4cec1aed 100644 --- a/drivers/media/usb/gspca/gspca.c +++ b/drivers/media/usb/gspca/gspca.c @@ -1178,6 +1178,7 @@ static void gspca_release(struct v4l2_device *v4l2_de= vice) v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler); v4l2_device_unregister(&gspca_dev->v4l2_dev); kfree(gspca_dev->usb_buf); + usb_put_dev(gspca_dev->dev); kfree(gspca_dev); } =20 @@ -1462,7 +1463,7 @@ int gspca_dev_probe2(struct usb_interface *intf, ret =3D -ENOMEM; goto out; } - gspca_dev->dev =3D dev; + gspca_dev->dev =3D usb_get_dev(dev); gspca_dev->iface =3D intf->cur_altsetting->desc.bInterfaceNumber; gspca_dev->xfer_ep =3D -1; =20 @@ -1574,6 +1575,7 @@ int gspca_dev_probe2(struct usb_interface *intf, if (sd_desc->probe_error) sd_desc->probe_error(gspca_dev); kfree(gspca_dev->usb_buf); + usb_put_dev(gspca_dev->dev); kfree(gspca_dev); return ret; } --=20 2.43.0