Commit 7c8bf63b7937 ("media: em28xx: use vb2_video_unregister_device")
converted device unregistrations in em28xx to use
vb2_video_unregister_device() instead of video_unregister_device().

However, radio devices do not have an associated videobuf2 queue
(v4l2->radio_dev.queue is NULL). Calling vb2_video_unregister_device()
on a radio device triggers a WARNING in vb2_video_unregister_device():

    !vdev->queue
    WARNING: drivers/media/common/videobuf2/videobuf2-v4l2.c:1264 at vb2_video_unregister_device+0x1f8/0x200
    Call Trace:
     em28xx_v4l2_init+0x1c39/0x3150 drivers/media/usb/em28xx/em28xx-video.c:3085

As documented in vb2_video_unregister_device(), video_unregister_device()
should be used instead when vdev->queue is NULL.

Revert to calling video_unregister_device() for v4l2->radio_dev in both
em28xx_v4l2_fini() and the em28xx_v4l2_init() error unwind path.

Fixes: 7c8bf63b7937 ("media: em28xx: use vb2_video_unregister_device")
Reported-by: syzbot+f26bc23e42eeb548dee1@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f26bc23e42eeb548dee1
Signed-off-by: Rohinthan P <rokinthanp03@gmail.com>
---
 drivers/media/usb/em28xx/em28xx-video.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
index c418add..79af154 100644
--- a/drivers/media/usb/em28xx/em28xx-video.c
+++ b/drivers/media/usb/em28xx/em28xx-video.c
@@ -2416,7 +2416,7 @@ static int em28xx_v4l2_fini(struct em28xx *dev)
 	if (video_is_registered(&v4l2->radio_dev)) {
 		dev_info(&dev->intf->dev, "V4L2 device %s deregistered\n",
 			 video_device_node_name(&v4l2->radio_dev));
-		vb2_video_unregister_device(&v4l2->radio_dev);
+		video_unregister_device(&v4l2->radio_dev);
 	}
 	if (video_is_registered(&v4l2->vbi_dev)) {
 		dev_info(&dev->intf->dev, "V4L2 device %s deregistered\n",
@@ -3082,7 +3082,7 @@ static int em28xx_v4l2_init(struct em28xx *dev)
 		dev_info(&dev->intf->dev,
 			 "V4L2 device %s deregistered\n",
 			 video_device_node_name(&v4l2->radio_dev));
-		vb2_video_unregister_device(&v4l2->radio_dev);
+		video_unregister_device(&v4l2->radio_dev);
 	}
 	if (video_is_registered(&v4l2->vbi_dev)) {
 		dev_info(&dev->intf->dev,
-- 
2.53.0

On 23/09/2026 09:20, Rohinthan P wrote:
> Commit 7c8bf63b7937 ("media: em28xx: use vb2_video_unregister_device")
> converted device unregistrations in em28xx to use
> vb2_video_unregister_device() instead of video_unregister_device().
> 
> However, radio devices do not have an associated videobuf2 queue
> (v4l2->radio_dev.queue is NULL). Calling vb2_video_unregister_device()
> on a radio device triggers a WARNING in vb2_video_unregister_device():
> 
>     !vdev->queue
>     WARNING: drivers/media/common/videobuf2/videobuf2-v4l2.c:1264 at vb2_video_unregister_device+0x1f8/0x200
>     Call Trace:
>      em28xx_v4l2_init+0x1c39/0x3150 drivers/media/usb/em28xx/em28xx-video.c:3085
> 
> As documented in vb2_video_unregister_device(), video_unregister_device()
> should be used instead when vdev->queue is NULL.
> 
> Revert to calling video_unregister_device() for v4l2->radio_dev in both
> em28xx_v4l2_fini() and the em28xx_v4l2_init() error unwind path.

Good catch!

This is actually a fix for the 7.3-rcX mainline.

I'll handle this.

Regards,

	Hans

> 
> Fixes: 7c8bf63b7937 ("media: em28xx: use vb2_video_unregister_device")
> Reported-by: syzbot+f26bc23e42eeb548dee1@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=f26bc23e42eeb548dee1
> Signed-off-by: Rohinthan P <rokinthanp03@gmail.com>
> ---
>  drivers/media/usb/em28xx/em28xx-video.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
> index c418add..79af154 100644
> --- a/drivers/media/usb/em28xx/em28xx-video.c
> +++ b/drivers/media/usb/em28xx/em28xx-video.c
> @@ -2416,7 +2416,7 @@ static int em28xx_v4l2_fini(struct em28xx *dev)
>  	if (video_is_registered(&v4l2->radio_dev)) {
>  		dev_info(&dev->intf->dev, "V4L2 device %s deregistered\n",
>  			 video_device_node_name(&v4l2->radio_dev));
> -		vb2_video_unregister_device(&v4l2->radio_dev);
> +		video_unregister_device(&v4l2->radio_dev);
>  	}
>  	if (video_is_registered(&v4l2->vbi_dev)) {
>  		dev_info(&dev->intf->dev, "V4L2 device %s deregistered\n",
> @@ -3082,7 +3082,7 @@ static int em28xx_v4l2_init(struct em28xx *dev)
>  		dev_info(&dev->intf->dev,
>  			 "V4L2 device %s deregistered\n",
>  			 video_device_node_name(&v4l2->radio_dev));
> -		vb2_video_unregister_device(&v4l2->radio_dev);
> +		video_unregister_device(&v4l2->radio_dev);
>  	}
>  	if (video_is_registered(&v4l2->vbi_dev)) {
>  		dev_info(&dev->intf->dev,