From nobody Mon Sep 28 08:12:15 2026 Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9C56A363C5F for ; Mon, 24 Aug 2026 13:51:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787579490; cv=none; b=J3mYZL4iiFkigBjHoWJqAyvPJ2zCSMnDaxPkVPitnKVuJCOmifSlHojZ+LXEq/E7dUj1G/qRJ92lsiKwEj4aLvcytcnBhtOOuiLeTZBKBEREfUmIPW+tL/v8AUsikkWpSQ+xNf0oOBz0CRIz9tjqzO/1xA9MN7aF07rTxxnkn2E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787579490; c=relaxed/simple; bh=iaN3lkHUtw9LcR00F1Y5+Wmzia7syR+lHqf8s3/QTCk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=DQxCT2UJEyjsrSAGk1YmNlgmWd2FIz0psbTyzlwAYBeIs5KrL1chUvn5JjllsYHnWfdaJsaRUDGrjaKsP3e8ALqVgP4XYeDI+/HWbq3pi7ZXUb+8nWigzbO1IHgKINymwjQgqICjWsE35CFACq2ev8/6ehiBHGa1MJE/3+f0EcU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Uwq+cIR5; arc=none smtp.client-ip=209.85.216.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Uwq+cIR5" Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-3811f512167so4818102a91.3 for ; Mon, 24 Aug 2026 06:51:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787579488; x=1788184288; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=dQQnGMOBsPPfE3BN6sWk+ZzltLNdJU7Eav06Vv4Dcts=; b=Uwq+cIR5vfpeUD/+hXJ2sfRRz7u91Aq98+N4PfGphjqypNlH0QBiwMGemOZn7IvPwN afPDFwHgpHJ9AcjvtbJwCUUSAYv45T7LN50AwhIRuLL3ecLeShn0ZLioneiR3ulLwwPC ZmlT6c/wA5AVBFaGeXo4bBnrbTiBh4AMBhErjJo9wgwSVK+PStKyL2myYtB1xlC4BS71 HoCB4fmZ9WdofWmglaCkvZ2m4nh0Ta60FkKpjOay+hPwuxXHjX2pnbWodOOzYsXcgi6U nIQW6sWVSjHSSm0xPz1YY1WOrDcr4X60M0t6UAGHyekYOe32zVlDOdIaQeKFf+ZvhdF9 E+wg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787579488; x=1788184288; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=dQQnGMOBsPPfE3BN6sWk+ZzltLNdJU7Eav06Vv4Dcts=; b=Xk/smm+08DofZdom8w7X3QOoQqfWR9CvdNsn/N9aXEgdkfw2pDNXJSm6ZNHWVj0T2/ 0LUAR5ssRFRMypyR26ekVWnB66Up3H1QX0hwOG22mh3xpecRCfeYZaNbtryYIuSb8BjM Y94w+8P4e/5Xwy0AXTaU9tsEyr+3SIczXUrqoG61BvPfXkLI6V8i+kCRDGKOBP3b5IlK +af4XuDl1BPKb5Bu5KW0Ap2vmg/PV04NioLjrAJan/u7NUnqKVn1BNOqlpQDVZ6aB07Z jdhATE5UE42nju1naj83LlZoBuGby/v5GYs2E+4hc+eCoVGt8iVQXGTXvi+rqkOePGTY zljg== X-Forwarded-Encrypted: i=1; AHgh+Rov5G42ag7LDloPh0AQ3ySJ2BpkiWOrg6bc4d/NGvDxYNGI+RXcgaDtxRBFCa3CpGoBFSpqqnYGaC8qvFU=@vger.kernel.org X-Gm-Message-State: AFuF++lFab4yDQ/ybOgMdXRn0+UkDUJTovmlXsulYbi+ABJZZKcHnje7 KXX/HSgQ73zW3Fm+/sW90Fwrtw3zKcNGi4NKDK9qrMFyM4Rqvg7mB+Ue X-Gm-Gg: AR+sD11ubBbpQH61bjcJR8NXiPJq+Ivw8XlJgoo2dM5gos0fzXKbUn0av1TTdzHnNO6 Z8vv2FAcML8/WA9qOtlbESt3SrodGGyRIVYZ6G3QCfoWC4aOs6GniFnEj88X44X+ahdISy2eFtn Eq68TtsGxIqllOMz9tPYOAn6LrgyqKC4V47B6U047QKqvqrYGbFC/wQuxu6V3jtWcoZ7FnMBJc5 y0aRauRrUfP9lBlS4BX5oK3gU/u9zt1fqoelTZunGPZxrMpXYyEGV2L2tlEJaU2UFcPfo4NfKAU R0BAfK6dGHkud+XWKaIxV/VMwVP09ZDAnz1i0jLOC4mlgx5mYxQwoeTWbgbOqpVERmE6EHCdUew MxxX97o4lcPYZDA7ydJTv1ypc4b4uvRGBxp037cESAMGVKbE9Nw+N6ebI4a1p2RPpcxql/IrW31 liddQMN5sXzgIuCUV8kfG0T8zwA2edr9FEJxAfpXSUtf84/2qZwHdoXkVDRbIZxGgHlxKO46n77 SWyHLqOhvK4rmpWx2XT6W6WcLU011zb9Vsg7wbPNM98lOd+87ht6z3qsauHlKrVvZq/F//JxHkb hGCC X-Received: by 2002:a17:90b:180d:b0:38e:2524:724f with SMTP id 98e67ed59e1d1-395c3733e65mr47728782a91.12.1787579487878; Mon, 24 Aug 2026 06:51:27 -0700 (PDT) Received: from lord-daniel-VivoBook-ASUSLaptop-K3502ZA-S3502ZA.. ([2409:40c0:106e:f291:ab34:e67f:7052:1767]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-141860c6e6dsm23487071c88.1.2026.08.24.06.51.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 24 Aug 2026 06:51:27 -0700 (PDT) From: Piyush Patle To: dwlsalmeida@gmail.com, mchehab@kernel.org Cc: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+32f018fd65e799f79ae0@syzkaller.appspotmail.com Subject: [PATCH] media: vidtv: fix frontend reference leak on unbind Date: Mon, 24 Aug 2026 19:21:15 +0530 Message-ID: <20260824135119.488592-1-piyushpatle228@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" dvb_register_frontend() keeps two references to the frontend. One is released by dvb_unregister_frontend(), and the other by dvb_frontend_detach(). vidtv only called dvb_unregister_frontend(), so the second reference was never released. As a result, __dvb_frontend_free() was never called, leaking the frontend private data and its struct dvb_device. The detach call was removed by commit 63101b756893 ("media: vidtv: fix driver unbind/remove") because it caused an OOPS. The demod .release callback freed vidtv_demod_state, and the I2C remove callbacks then accessed the freed state. That commit also removed those accesses from the I2C remove callbacks. Restore the detach call, but remove the demod .release callback. vidtv_demod_state is owned by the I2C client and is already freed by vidtv_demod_i2c_remove(), so the frontend detach path should not free it. Tested with kmemleak and KASAN over 10 bind/unbind cycles. The reported frontend and dvb_device leaks were present before the fix and were gone after it, with no KASAN reports. Reported-by: syzbot+32f018fd65e799f79ae0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3D32f018fd65e799f79ae0 Fixes: 63101b756893 ("media: vidtv: fix driver unbind/remove") Tested-by: syzbot+32f018fd65e799f79ae0@syzkaller.appspotmail.com Signed-off-by: Piyush Patle --- drivers/media/test-drivers/vidtv/vidtv_bridge.c | 2 ++ drivers/media/test-drivers/vidtv/vidtv_demod.c | 9 --------- 2 files changed, 2 insertions(+), 9 deletions(-) diff --git a/drivers/media/test-drivers/vidtv/vidtv_bridge.c b/drivers/medi= a/test-drivers/vidtv/vidtv_bridge.c index fd69b4ee16f4..9887860b0198 100644 --- a/drivers/media/test-drivers/vidtv/vidtv_bridge.c +++ b/drivers/media/test-drivers/vidtv/vidtv_bridge.c @@ -474,6 +474,7 @@ static int vidtv_bridge_dvb_init(struct vidtv_dvb *dvb) fail_demod_probe: for (i =3D i - 1; i >=3D 0; --i) { dvb_unregister_frontend(dvb->fe[i]); + dvb_frontend_detach(dvb->fe[i]); fail_fe: dvb_module_release(dvb->i2c_client_tuner[i]); fail_tuner_probe: @@ -552,6 +553,7 @@ static void vidtv_bridge_remove(struct platform_device = *pdev) =20 for (i =3D 0; i < NUM_FE; ++i) { dvb_unregister_frontend(dvb->fe[i]); + dvb_frontend_detach(dvb->fe[i]); dvb_module_release(dvb->i2c_client_tuner[i]); dvb_module_release(dvb->i2c_client_demod[i]); } diff --git a/drivers/media/test-drivers/vidtv/vidtv_demod.c b/drivers/media= /test-drivers/vidtv/vidtv_demod.c index 6e5fe402976b..3aa586004638 100644 --- a/drivers/media/test-drivers/vidtv/vidtv_demod.c +++ b/drivers/media/test-drivers/vidtv/vidtv_demod.c @@ -343,13 +343,6 @@ static int vidtv_diseqc_send_burst(struct dvb_frontend= *fe, return 0; } =20 -static void vidtv_demod_release(struct dvb_frontend *fe) -{ - struct vidtv_demod_state *state =3D fe->demodulator_priv; - - kfree(state); -} - static const struct dvb_frontend_ops vidtv_demod_ops =3D { .delsys =3D { SYS_DVBT, @@ -390,8 +383,6 @@ static const struct dvb_frontend_ops vidtv_demod_ops = =3D { FE_CAN_HIERARCHY_AUTO, }, =20 - .release =3D vidtv_demod_release, - .set_frontend =3D vidtv_demod_set_frontend, .get_frontend =3D vidtv_demod_get_frontend, =20 --=20 2.43.0