* Re: [PATCH v2] media: as102: drop device reference on probe failure
2026-06-23 4:39 ` [PATCH v2] media: as102: drop device reference on probe failure Jiawen Liu
@ 2026-06-23 8:50 ` Bryan O'Donoghue
0 siblings, 0 replies; 2+ messages in thread
From: Bryan O'Donoghue @ 2026-06-23 8:50 UTC (permalink / raw)
To: Jiawen Liu, mchehab
Cc: hverkuil+cisco, kees, linux-media, linux-kernel, stable
On 23/06/2026 05:39, Jiawen Liu wrote:
> as102_usb_probe() initializes the kref and takes a USB device reference
> before registering the USB minor.
>
> The change named in the Fixes tag avoided freeing as102_dev directly
> after usb_register_dev() succeeds, because userspace can open the minor
> before a later probe failure and hold an extra kref until release.
>
> However, the stream-allocation and DVB-registration failure paths now
> deregister the USB minor and return without dropping the probe path
> initial kref. That leaves the USB device reference held by as102_dev
> leaked.
>
> Drop the initial reference with kref_put() after usb_deregister_dev(). If
> no userspace file is open, as102_usb_release() releases the USB device
> and frees as102_dev immediately. If a file is open, the final free is
> deferred until the last file release drops the remaining kref.
>
> Fixes: 8bd29dbe03fc ("media: as102: fix to not free memory after the device is registered in as102_usb_probe()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiawen Liu <1298662399@qq.com>
> ---
> drivers/media/usb/as102/as102_usb_drv.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/media/usb/as102/as102_usb_drv.c b/drivers/media/usb/as102/as102_usb_drv.c
> index a11024451ceb..ad6c5837f1d7 100644
> --- a/drivers/media/usb/as102/as102_usb_drv.c
> +++ b/drivers/media/usb/as102/as102_usb_drv.c
> @@ -405,6 +405,7 @@ static int as102_usb_probe(struct usb_interface *intf,
> failed_stream:
> usb_set_intfdata(intf, NULL);
> usb_deregister_dev(intf, &as102_usb_class_driver);
> + kref_put(&as102_dev->kref, as102_usb_release);
> return ret;
> failed:
> usb_put_dev(as102_dev->bus_adap.usb_dev);
>
> base-commit: 9e7e6633458362db72427b48effad8d759131c35
> --
> 2.34.1
>
Your kref_put() is correct but, the jump labels should be collapsed down
to a single return.
diff --git a/drivers/media/usb/as102/as102_usb_drv.c
b/drivers/media/usb/as102/as102_usb_drv.c
index a11024451cebd..2e6c9b50ee5ff 100644
--- a/drivers/media/usb/as102/as102_usb_drv.c
+++ b/drivers/media/usb/as102/as102_usb_drv.c
@@ -403,13 +403,10 @@ static int as102_usb_probe(struct usb_interface *intf,
failed_dvb:
as102_free_usb_stream_buffer(as102_dev);
failed_stream:
- usb_set_intfdata(intf, NULL);
usb_deregister_dev(intf, &as102_usb_class_driver);
- return ret;
failed:
- usb_put_dev(as102_dev->bus_adap.usb_dev);
usb_set_intfdata(intf, NULL);
- kfree(as102_dev);
+ kref_put(&as102_dev->kref, as102_usb_release);
return ret;
}
---
bod
^ permalink raw reply [flat|nested] 2+ messages in thread