From nobody Fri Aug 14 15:49:20 2026 Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 58CDE477E52 for ; Fri, 14 Aug 2026 13:41:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786714868; cv=none; b=C5tp5nqqNJncq5oSe9XDhPrv7gYuOcmVHFeS0RHzmFwzRDtSsVroIh36x2Gmk51Ul9/xJQkdnNy+op344TGkTdOU1kAwM0TVVBkr0Clj9bNF3w0jpuYBgriK+qnv4Ztuv8ggi5SDzBr2SPR/ACHqdUiTUI7W8hcDT8+PgXjMJ1w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786714868; c=relaxed/simple; bh=PqBnIeW+UOiXNmqu1QbWmEKTGtUcTjE+KWkPWTsNXSM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=L/X4vsxjjn5GqME45QoPgbooLLgoK03+y/Tmih2y4ToCQVluh5RSa1p+Di96an/NKygcN/KM0oTNXs8VZdO0hX3E72PcOK5q3++a91I97ci/6O+01a+dcksOrld5YHu7f/zEyzdlR3HR23zOQRieykAJzVCCSV9arcZZY2rMF4Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=aohMCvwt; arc=none smtp.client-ip=209.85.216.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="aohMCvwt" Received: by mail-pj1-f49.google.com with SMTP id 98e67ed59e1d1-38fdeaed181so1472423a91.1 for ; Fri, 14 Aug 2026 06:41:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786714866; x=1787319666; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=tuserjfmudQFk0/rFIBaVa/4z/3CGpRiipPmxmBr8zQ=; b=aohMCvwt3D8lrRSviBQUdnEAXkhX926475DnoK/XQSrif6cZmm7FVTojCjY1PYbrdu p94npjm1caRYSLyeSjF/Fv49czUdO1jnQeC2bFiVcIzy6SJsHB2/IupaW5tpLrAc5bn/ vqqLZ6klABPQBPHx3jy1RBFHhj3BIM3MzIw2KTSYpx4UAeiLG6Ujob4nXaQHsexry0vh JC2qdK0+WeeDKBO3hYIrR0myEH34/QXqIYlLcm3ewzq6euj0hI8VspW2r7Vixy7APX/U iuFoPCQll5kvRWnTtjR6ELiV1mdTtb4q5nEguPVJbYpTH7fSrWO7Btj5Tf2urBI9jjq9 ES1A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786714866; x=1787319666; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=tuserjfmudQFk0/rFIBaVa/4z/3CGpRiipPmxmBr8zQ=; b=onrT43UUPo5vyx/FVHkWV5mLYpcFc1tM7qkIn5Cjvi1nedOhqBGK4TxEpj2B7OpYNY EiWip98LnsqM3asnGg7ZmrccRuapA1em6yvFCXJMydRWw6pP0fla5KR/86aq2WTWsq7M +3PzwNUkEURbP5A9iAUlV7IXZXA+mBrgLhBAHrqETLOVu1BcLjqU5LHhi7UWGJBXeHgv /saPvfAzOQlDh4IvdqWGZQb8ikwIPog82iC1qprszR15SZcKxvMg2E1DVwY5PPQJ4cVY XaBmQnAkdRPqJi6D1MqCBNvufU6VIXW8Y4m0z+RgJHA9T/7C1e0BLU0sEjms+sqgDVIj lHRQ== X-Forwarded-Encrypted: i=1; AHgh+RqCIopmlflf4UDQifu4bK7pzIZFKLeX+JbXHSzN1LegWywojfh90HnE3WkTeErEqWIjQ3HSlYB6FywAVUg=@vger.kernel.org X-Gm-Message-State: AOJu0YwXlACSwnMw7qWnJvB0slvCpe46c4TyHIRzsvEMAMio5nlgRicZ p/Y1KkvgZNBJD6D4VYXOzlC6CdXbU9E4QsMZlaNowtr7gESwMfkyvDrJ4kJ46HOTNRI= X-Gm-Gg: AR+sD10trjZ642I4yqHUBsb9hm09Ah7lodwloDyuMth6yn2/jVl/sl10pOngbJXUCWe SeynKFVX84nufxY7ztYbAscq/CdtgcCYoX20wQ9isuUNpzdvU/Vbw9rxmdQ7NkBTmKyHOXgbpkn 8FXIMwUP33GJzjxTfoZ9jMf9jOKtXstP69Hrr0h1M/Ul+yf2w3y7UBoTSThkjeuHyz17fXaRljo ZNbMgDcd3gMweduCvQNHNt3YWXPmYNcAvwYYz0LWhxc3xBCTgQbZ7YMjHjP4Y7aeV0qws2xtC4G nqeOULv9FxY3IMT8rNlkaZhUIRz+4uVpmA9k+sJthajncyaRnZ24rgzn7/kg664hvl9BD8OTTG7 k7LDl7GtSPQR96us1dKB0BXRffBT3D1igT20ivnSE7eykX7eqngny/31v8LmKsj+9tTjg/eZ2WK UlRb28lPy7vBh8q2LkNhraixhHk3mQUWr/zqzbC1KXP5LyAxy5d0JxDoD6rbIWIyt4z6Ebsiqd9 Kr6IL4t X-Received: by 2002:a17:90b:5807:b0:37f:ed7e:7e42 with SMTP id 98e67ed59e1d1-3933b958ad5mr6627036a91.14.1786714865667; Fri, 14 Aug 2026 06:41:05 -0700 (PDT) Received: from haichao.tail057a43.ts.net ([2001:da8:e000:1206:e9af:7c0e:be31:2c3f]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-394ea97207fsm2766660a91.1.2026.08.14.06.41.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 14 Aug 2026 06:41:05 -0700 (PDT) From: Ruoyu Wang To: Mauro Carvalho Chehab , Steven Toth Cc: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Ruoyu Wang Subject: [PATCH] media: au0828: Free URBs when starting DVB streaming fails Date: Fri, 14 Aug 2026 21:41:00 +0800 Message-ID: <20260814134100.1387349-1-ruoyuw560@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" start_urb_transfer() stores each allocated URB in dev->urbs[], but sets urb_streaming only after all URBs have been submitted. If a later URB or transfer buffer allocation fails, earlier entries are left allocated. A submission failure calls stop_urb_transfer(), but that function returns immediately while urb_streaming is false, leaving both submitted and unsubmitted URBs behind. Make stop_urb_transfer() release every populated slot regardless of the streaming flag and clear each slot after release. Route all start errors through this cleanup. usb_kill_urb() safely handles both submitted and unsubmitted URBs, while the existing preallocation check preserves the lifetime of shared transfer buffers. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: 265a6510629a ("V4L/DVB (7621): Add support for Hauppauge HVR950Q/HVR= 850/FusioHDTV7-USB") Signed-off-by: Ruoyu Wang --- drivers/media/usb/au0828/au0828-dvb.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/drivers/media/usb/au0828/au0828-dvb.c b/drivers/media/usb/au08= 28/au0828-dvb.c index 31123e6f9fc31..aecc133ea11bb 100644 --- a/drivers/media/usb/au0828/au0828-dvb.c +++ b/drivers/media/usb/au0828/au0828-dvb.c @@ -163,9 +163,6 @@ static int stop_urb_transfer(struct au0828_dev *dev) =20 dprintk(2, "%s()\n", __func__); =20 - if (!dev->urb_streaming) - return 0; - if (dev->bulk_timeout_running =3D=3D 1) { dev->bulk_timeout_running =3D 0; timer_delete(&dev->bulk_timeout); @@ -179,6 +176,7 @@ static int stop_urb_transfer(struct au0828_dev *dev) kfree(dev->urbs[i]->transfer_buffer); =20 usb_free_urb(dev->urbs[i]); + dev->urbs[i] =3D NULL; } } =20 @@ -200,8 +198,10 @@ static int start_urb_transfer(struct au0828_dev *dev) for (i =3D 0; i < URB_COUNT; i++) { =20 dev->urbs[i] =3D usb_alloc_urb(0, GFP_KERNEL); - if (!dev->urbs[i]) - return -ENOMEM; + if (!dev->urbs[i]) { + ret =3D -ENOMEM; + goto err; + } =20 purb =3D dev->urbs[i]; =20 @@ -217,7 +217,7 @@ static int start_urb_transfer(struct au0828_dev *dev) ret =3D -ENOMEM; pr_err("%s: failed big buffer allocation, err =3D %d\n", __func__, ret); - return ret; + goto err; } =20 purb->status =3D -EINPROGRESS; @@ -235,10 +235,9 @@ static int start_urb_transfer(struct au0828_dev *dev) for (i =3D 0; i < URB_COUNT; i++) { ret =3D usb_submit_urb(dev->urbs[i], GFP_ATOMIC); if (ret !=3D 0) { - stop_urb_transfer(dev); pr_err("%s: failed urb submission, err =3D %d\n", __func__, ret); - return ret; + goto err; } } =20 @@ -249,6 +248,10 @@ static int start_urb_transfer(struct au0828_dev *dev) dev->bulk_timeout_running =3D 1; =20 return 0; + +err: + stop_urb_transfer(dev); + return ret; } =20 static void au0828_start_transport(struct au0828_dev *dev) --=20 2.51.0