From nobody Tue Sep 29 10:32:48 2026 Received: from mail-pg1-f175.google.com (mail-pg1-f175.google.com [209.85.215.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E75FA391E7C for ; Sun, 9 Aug 2026 10:17:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.175 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786270647; cv=none; b=UuyBH9y7lwwYdI4mP6kimCRLXMOQTlp9juG6LK5uwz/0Y1CDo0ilGB9cUUQ1/4pR9INCpcFY3YbYgDlIwl/caR7tYAfVPy7STbw/H+FLuKfKnci+ZToVZ5mSIe6aeI/TI2qFu3kiroxoTpCWx+xk/Wp8iet0luH9kwgZtJ8aDeg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786270647; c=relaxed/simple; bh=RvmzwK4dlyG2JGoHxX32qWKM1EMpKArPl1QuK0QEqAI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=nPqNX2yQ2D3lipCvYYZ3Bu6hGdp6R3+2cGudnchArV/wn4pHPle5TfXQbmtHtq++c9wEmq8bsTqjnlrQqYNk7Vut7wStz0WitM+mi2Asl3kAECYFLvFes3/N5kMS5cT18lBTNrdfh46jbrtI/aY2P0lxHvFB7YC8aK+ybXMcmUg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ARldIPFD; arc=none smtp.client-ip=209.85.215.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ARldIPFD" Received: by mail-pg1-f175.google.com with SMTP id 41be03b00d2f7-ca88130e09aso612192a12.3 for ; Sun, 09 Aug 2026 03:17:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786270644; x=1786875444; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=Y4SiRXpVk5uM6KSMknWzyY90uVTBQIGYj5y9bvf1u24=; b=ARldIPFDkzbBELNfI5X7LX4znIEQuOdw8gcyodocMNRfcK+Ecf3+6iKjLR1VyCnkiw 1GMrVyLkQekI2Zyo3bLr2qYMVJQBVLu+yTt7/VPQk21GFyW82cw/vrRgSZvCWBJs2kB/ BTIbDKWUiockWO6IdQiXqSg0CSYF9kEgsMo1KyEyaTfOqlF3sJJo+tDU5/YpQl1hDTik /kIvrgTK13I+cXFUHY+PNiaJyIgLHhKfN/aEsicz2ajLqvbI2ICaw2A8NLQJfBkVsshk 2INr+Ujsh6G4JYOu0NUbH2q53edthn0rL6Y49CQVepjyU3UVJ6jdxiv+fUDd2+eIgZRg Nk/Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786270644; x=1786875444; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Y4SiRXpVk5uM6KSMknWzyY90uVTBQIGYj5y9bvf1u24=; b=kJWChmMJAcvDPGEEE1Kyh8X8pYNtPQvQowWbLtS/VvAH0AT5+VgVdI0Rev8kCk2Tr8 G6sKiC4x+S26s4yJ4EQX5KX9RPfv8zq8uxTwiYkMdZ65I7h8UG6Qs8V8Gr/CQefSN7kZ Ep8FEn5iDeRSpsqvuBuc8gauF8GzEWAo7b3FziKEJrIBHMnDnHZdpTAcN9hGvrBTkHSj GG+OVEysIMIUGzpSTprSQa11CzLszDSixDLYGJ1OPe39wR1nWrYGXz/4I3UxxTFw+rx7 ojGMbCrgel1iQjH8mXBvJx4WgEiTcxVJLQOc8/MnTqbJh9oCyNYRPDjiaV91cp4wMs/6 mrOg== X-Forwarded-Encrypted: i=1; AHgh+RoROz7hXtdtN9946vrxTJ/SqW9IbPcMtvmNH4vElg49iAPUZWzdHi6FhbEPKor8B9CO0ZQ9fkMihFzkBCs=@vger.kernel.org X-Gm-Message-State: AOJu0YyGvTLanHSdPY/ceopm0Bf812yeG7uYIkGqdQlphwvcfDVaf7ls aF6Bi1gccQfAhWWtmLd+5UdZeh0tsGE+ZfnCN0v7YjNOOuN8afvH+Q2y5EDkWyKCp7c= X-Gm-Gg: AR+sD12jcn9JCF6LY3235CgUuyNwFtFhfR4d09pUAw8h8/7ikvSXTY9GWU6Oit30iPY aFqEup41zRTkGevdQ31b4YUD3uqRn5czXUVJ+DXrZWylbvZGE41mqojTi8cuq09JMYNAczJt1W8 ThT0gaXlwdfJhQ2Jc+BkEyA0fnJiIlDXVbzqnoS0L4HYn91sc7SYgTG26T30hfT7/mGpjIXl7Jf f+ujrPu+XPRchznzJEsrvofC/TbYTACGVRdw4Twyp80EgOL0vGqENFlVcChgI72/NWeax2eQIsf F8C+SEbFCWDex5w85ik4aSW4UaCQxzYjiz+aDutzEKoJrGGGdpUZZq1GZlYnZTp9djH1uvJDrBu TO//1GuMTt3/0ekdWcITPOBE5bc7dWay/8p58CGHue7SbSNdiV0pAag6olilBY3UN58l7FlWO7A GrQ8SDhlNAhgZusNmpneNAFwr1qy2NEtSMG2vqIZf8dsPZ2bbb8+g/ggVzWtNi4paO0Vnif3PfI 0a89YEYPXBvq/l0jaXR/PA/2A2cwhpVURuNpC9/XKswl7pvjWXrgtHG3d8kvb2zLq5gISaQPIwt F3yeJOX4NPrNHzzmFcJ2tILVvnlURu5Lz78d61F7Hrc05Oe7STlr+oVzWZDAQCuy60al9Ayjns9 IdAXsL5fSWcx2YjJs9cwhcXCWd5UwYKkqccckAbRMZWlKOjJA X-Received: by 2002:a05:6a20:d52c:b0:3c3:812a:2198 with SMTP id adf61e73a8af0-3cb85df190amr44418663637.4.1786270644170; Sun, 09 Aug 2026 03:17:24 -0700 (PDT) Received: from localhost.localdomain ([101.251.7.10]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-315bec128a0sm33347654eec.25.2026.08.09.03.17.22 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sun, 09 Aug 2026 03:17:23 -0700 (PDT) From: Laxman Acharya Padhya To: Mauro Carvalho Chehab Cc: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] media: dvbdev: fix stale minor on registration failure Date: Sun, 9 Aug 2026 16:02:18 +0545 Message-ID: <20260809101718.24495-1-acharyalaxman8848@gmail.com> X-Mailer: git-send-email 2.51.2 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" dvb_register_device() gives the new device one reference and publishes a second reference through dvb_minors[] before media-device registration and device_create() complete. If either operation fails, the current error paths free the device directly. The published minor then retains a pointer to freed memory, and the global DVB character device can pass that pointer to dvb_device_open(). Route both failures through one cleanup path. Remove the minor under minor_rwsem, drop its reference, release the registration resources, and finally drop the initial device reference. Assisted-by: ChatGPT:gpt-5 Signed-off-by: Laxman Acharya Padhya --- drivers/media/dvb-core/dvbdev.c | 42 ++++++++++++++++----------------- 1 file changed, 20 insertions(+), 22 deletions(-) diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbde= v.c index d753d329502a..9a2783175771 100644 --- a/drivers/media/dvb-core/dvbdev.c +++ b/drivers/media/dvb-core/dvbdev.c @@ -551,36 +551,17 @@ int dvb_register_device(struct dvb_adapter *adap, str= uct dvb_device **pdvbdev, if (ret) { pr_err("%s: dvb_register_media_device failed to create the mediagraph\n", __func__); - if (new_node) { - list_del(&new_node->list_head); - kfree(dvbdevfops); - kfree(new_node); - } - dvb_media_device_free(dvbdev); - list_del(&dvbdev->list_head); - kfree(dvbdev); - *pdvbdev =3D NULL; - mutex_unlock(&dvbdev_register_lock); - return ret; + goto err_register; } =20 clsdev =3D device_create(dvb_class, adap->device, MKDEV(DVB_MAJOR, minor), dvbdev, "dvb%d.%s%d", adap->num, dnames[type], id); if (IS_ERR(clsdev)) { + ret =3D PTR_ERR(clsdev); pr_err("%s: failed to create device dvb%d.%s%d (%pe)\n", __func__, adap->num, dnames[type], id, clsdev); - if (new_node) { - list_del(&new_node->list_head); - kfree(dvbdevfops); - kfree(new_node); - } - dvb_media_device_free(dvbdev); - list_del(&dvbdev->list_head); - kfree(dvbdev); - *pdvbdev =3D NULL; - mutex_unlock(&dvbdev_register_lock); - return PTR_ERR(clsdev); + goto err_register; } =20 dprintk("DVB: register adapter%d/%s%d @ minor: %i (0x%02x)\n", @@ -588,6 +569,23 @@ int dvb_register_device(struct dvb_adapter *adap, stru= ct dvb_device **pdvbdev, =20 mutex_unlock(&dvbdev_register_lock); return 0; + +err_register: + down_write(&minor_rwsem); + dvb_minors[minor] =3D NULL; + dvb_device_put(dvbdev); + up_write(&minor_rwsem); + if (new_node) { + list_del(&new_node->list_head); + kfree(dvbdevfops); + kfree(new_node); + } + dvb_media_device_free(dvbdev); + list_del(&dvbdev->list_head); + *pdvbdev =3D NULL; + mutex_unlock(&dvbdev_register_lock); + dvb_device_put(dvbdev); + return ret; } EXPORT_SYMBOL(dvb_register_device); =20 --=20 2.51.2