[PATCH] media: gspca: hold a usb_device reference while registered

[PATCH] media: gspca: hold a usb_device reference while registered

[Shuangpeng Bai]

gspca keeps a pointer to the probed struct usb_device in
gspca_dev->dev, but it does not hold a reference to it. The
V4L2/video-device reference can keep the outer gspca_dev alive after USB
disconnect, and the streaming queue can then be canceled from the last
file release path.

That late release path still calls into gspca_stream_off(), which may
call sub-driver stop callbacks or usb_set_interface() and dereference
gspca_dev->dev after the USB core has freed the device.

Take a reference to the usb_device when storing it in gspca_dev and drop
it from the final gspca_release() path. Balance the reference in the
probe error path as well.

Fixes: 63eb9546dcb5 ("V4L/DVB (8152): Initial release of gspca with only one driver.")
Cc: stable@vger.kernel.org
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
---
 drivers/media/usb/gspca/gspca.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspca.c
index 594d73e50b9f..59eb4cec1aed 100644
--- a/drivers/media/usb/gspca/gspca.c
+++ b/drivers/media/usb/gspca/gspca.c
@@ -1178,6 +1178,7 @@ static void gspca_release(struct v4l2_device *v4l2_device)
 	v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler);
 	v4l2_device_unregister(&gspca_dev->v4l2_dev);
 	kfree(gspca_dev->usb_buf);
+	usb_put_dev(gspca_dev->dev);
 	kfree(gspca_dev);
 }
 
@@ -1462,7 +1463,7 @@ int gspca_dev_probe2(struct usb_interface *intf,
 		ret = -ENOMEM;
 		goto out;
 	}
-	gspca_dev->dev = dev;
+	gspca_dev->dev = usb_get_dev(dev);
 	gspca_dev->iface = intf->cur_altsetting->desc.bInterfaceNumber;
 	gspca_dev->xfer_ep = -1;
 
@@ -1574,6 +1575,7 @@ int gspca_dev_probe2(struct usb_interface *intf,
 	if (sd_desc->probe_error)
 		sd_desc->probe_error(gspca_dev);
 	kfree(gspca_dev->usb_buf);
+	usb_put_dev(gspca_dev->dev);
 	kfree(gspca_dev);
 	return ret;
 }
-- 
2.43.0

Re: [PATCH] media: gspca: hold a usb_device reference while registered

[Hans Verkuil]

On 18/07/2026 04:54, Shuangpeng Bai wrote:
> gspca keeps a pointer to the probed struct usb_device in
> gspca_dev->dev, but it does not hold a reference to it. The
> V4L2/video-device reference can keep the outer gspca_dev alive after USB
> disconnect, and the streaming queue can then be canceled from the last
> file release path.
> 
> That late release path still calls into gspca_stream_off(), which may
> call sub-driver stop callbacks or usb_set_interface() and dereference
> gspca_dev->dev after the USB core has freed the device.
> 
> Take a reference to the usb_device when storing it in gspca_dev and drop
> it from the final gspca_release() path. Balance the reference in the
> probe error path as well.
> 
> Fixes: 63eb9546dcb5 ("V4L/DVB (8152): Initial release of gspca with only one driver.")
> Cc: stable@vger.kernel.org
> Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
> ---
>  drivers/media/usb/gspca/gspca.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspca.c
> index 594d73e50b9f..59eb4cec1aed 100644
> --- a/drivers/media/usb/gspca/gspca.c
> +++ b/drivers/media/usb/gspca/gspca.c
> @@ -1178,6 +1178,7 @@ static void gspca_release(struct v4l2_device *v4l2_device)
>  	v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler);
>  	v4l2_device_unregister(&gspca_dev->v4l2_dev);
>  	kfree(gspca_dev->usb_buf);
> +	usb_put_dev(gspca_dev->dev);
>  	kfree(gspca_dev);
>  }
>  
> @@ -1462,7 +1463,7 @@ int gspca_dev_probe2(struct usb_interface *intf,
>  		ret = -ENOMEM;
>  		goto out;
>  	}
> -	gspca_dev->dev = dev;
> +	gspca_dev->dev = usb_get_dev(dev);
>  	gspca_dev->iface = intf->cur_altsetting->desc.bInterfaceNumber;
>  	gspca_dev->xfer_ep = -1;
>  
> @@ -1574,6 +1575,7 @@ int gspca_dev_probe2(struct usb_interface *intf,
>  	if (sd_desc->probe_error)
>  		sd_desc->probe_error(gspca_dev);
>  	kfree(gspca_dev->usb_buf);
> +	usb_put_dev(gspca_dev->dev);
>  	kfree(gspca_dev);
>  	return ret;
>  }

Actually, the better solution is to replace v4l2_device_unregister()
by vb2_v4l2_device_unregister() in gspca_disconnect. That ensures that the
queue is canceled at disconnect time.

Regards,

	Hans