From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oi1-f199.google.com (mail-oi1-f199.google.com [209.85.167.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4F4EB3E9C33 for ; Mon, 24 Aug 2026 06:59:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.199 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787554758; cv=none; b=SbRDq7MaihYcSqUttJ+DsZDJIfjZHrd/ygJukOISqBIZqvKxc3AO0RZfQ3FExEdtSYmXazxhdC3/S4l7WR1aSeGrvZnWTuN19WzYluXI8+xjtK/mrj8RhwgO6Oyr40MI0eq+jy6A+i091lKAR4ND6+RNQCYeINR8agKiRhvzgvQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787554758; c=relaxed/simple; bh=/OiUU3gFG3pKMtf+UJQiGgWuQtBs2/lhQcmlPqGh2Jo=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=hqnz2N+YKCrWfqYk9AHiY0H4u/GoBNROIIlWGi+LwGf6QsLGClLMqbfibLtjaI3bsHtcJa7xvepUjnFaUzO1hnryLiHpzWo0WP5clBpaZuyxyh6dzOIhVLnExjWdaLFQK0jc4aqSlbw0i0buSjBHiUKxSBi4okMPOax+8aPqjpo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.167.199 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oi1-f199.google.com with SMTP id 5614622812f47-4a45b3f0bdfso6344352b6e.1 for ; Sun, 23 Aug 2026 23:59:17 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787554756; x=1788159556; h=content-type:to:from:subject:message-id:in-reply-to:date :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=MG7StJG2LrNfxLd8bmQgdat4omzHkhvarlB9IbuU2PA=; b=H/8dcjCtyY5LG6nrv0OuZN4NBPmIc/6l1PVjK5mi6GcpJSNXYywMvKtIGzu7iT97kP rw3kzt8jktit+FsQ7GSUyMPgyekPv+wiZKMDhffXeSGOpsH4rEbLeMdsOODwp75uL6ip FlvHLkNTaM4jK/6Crl+iU4eQh4wioR3dAky02zSbIx0oz2yKoRZuPbXzlFk8do0mu9bk 0Wvg0vHZua8cS7r7GE0ZUtJQcB1li4wDD9xS0Ehtl2ARbSCyqaasLYau9+FOTLYcX6ey YzmoKSrdgPRzDSxAe05xsu6B6lbAH3oaz4fn/nodiAFJsimsKTim0P8vkxT6RpA7xcf7 fl5g== X-Gm-Message-State: AFuF++nlZ8bxcUfdyjfvjqHnrQwftxqrk7lmdPdYT9B58R+LM6wrnn+A ViPg9xJsJBPUhbtY+0XOX2D864QckGP607jsXIG1RCBvV0avKLFWeYeFISkMg+t5qyr4Zxz9l/F uAAUYeghrzZRi16FRIzi7wWGPQffS8qZ/cft77h9rRAIEHWjCUdYkFHwwY5E= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6808:d54:b0:4b2:8e24:799 with SMTP id 5614622812f47-4b2ef3cfea6mr22187857b6e.17.1787554756222; Sun, 23 Aug 2026 23:59:16 -0700 (PDT) Date: Sun, 23 Aug 2026 23:59:16 -0700 In-Reply-To: <6a8bbc09.dbb3a75c.13dd47.005c.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6a8bebc4.91706f20.16b6e3.02d0.GAE@google.com> Subject: Forwarded: [PATCH] media: vidtv: fix frontend reference leak on unbind From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: [PATCH] media: vidtv: fix frontend reference leak on unbind Author: piyushpatle228@gmail.com dvb_register_frontend() keeps two references to the frontend. One is released by dvb_unregister_frontend(), and the other by dvb_frontend_detach(). vidtv only called dvb_unregister_frontend(), so the second reference was never released. As a result, __dvb_frontend_free() was never called, leaking the frontend private data and its struct dvb_device. The detach call was removed by commit 63101b756893 ("media: vidtv: fix driver unbind/remove") because it caused an OOPS. The demod .release callback freed vidtv_demod_state, and the I2C remove callbacks then accessed the freed state. That commit also removed those accesses from the I2C remove callbacks. Restore the detach call, but remove the demod .release callback. vidtv_demod_state is owned by the I2C client and is already freed by vidtv_demod_i2c_remove(), so the frontend detach path should not free it. Tested with kmemleak and KASAN over 10 bind/unbind cycles. The reported frontend and dvb_device leaks were present before the fix and were gone after it, with no KASAN reports. Reported-by: syzbot+32f018fd65e799f79ae0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=32f018fd65e799f79ae0 Fixes: 63101b756893 ("media: vidtv: fix driver unbind/remove") Signed-off-by: Piyush Patle --- #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master drivers/media/test-drivers/vidtv/vidtv_bridge.c | 2 ++ drivers/media/test-drivers/vidtv/vidtv_demod.c | 9 --------- 2 files changed, 2 insertions(+), 9 deletions(-) diff --git a/drivers/media/test-drivers/vidtv/vidtv_bridge.c b/drivers/media/test-drivers/vidtv/vidtv_bridge.c index fd69b4ee16f4..9887860b0198 100644 --- a/drivers/media/test-drivers/vidtv/vidtv_bridge.c +++ b/drivers/media/test-drivers/vidtv/vidtv_bridge.c @@ -474,6 +474,7 @@ static int vidtv_bridge_dvb_init(struct vidtv_dvb *dvb) fail_demod_probe: for (i = i - 1; i >= 0; --i) { dvb_unregister_frontend(dvb->fe[i]); + dvb_frontend_detach(dvb->fe[i]); fail_fe: dvb_module_release(dvb->i2c_client_tuner[i]); fail_tuner_probe: @@ -552,6 +553,7 @@ static void vidtv_bridge_remove(struct platform_device *pdev) for (i = 0; i < NUM_FE; ++i) { dvb_unregister_frontend(dvb->fe[i]); + dvb_frontend_detach(dvb->fe[i]); dvb_module_release(dvb->i2c_client_tuner[i]); dvb_module_release(dvb->i2c_client_demod[i]); } diff --git a/drivers/media/test-drivers/vidtv/vidtv_demod.c b/drivers/media/test-drivers/vidtv/vidtv_demod.c index 6e5fe402976b..3aa586004638 100644 --- a/drivers/media/test-drivers/vidtv/vidtv_demod.c +++ b/drivers/media/test-drivers/vidtv/vidtv_demod.c @@ -343,13 +343,6 @@ static int vidtv_diseqc_send_burst(struct dvb_frontend *fe, return 0; } -static void vidtv_demod_release(struct dvb_frontend *fe) -{ - struct vidtv_demod_state *state = fe->demodulator_priv; - - kfree(state); -} - static const struct dvb_frontend_ops vidtv_demod_ops = { .delsys = { SYS_DVBT, @@ -390,8 +383,6 @@ static const struct dvb_frontend_ops vidtv_demod_ops = { FE_CAN_HIERARCHY_AUTO, }, - .release = vidtv_demod_release, - .set_frontend = vidtv_demod_set_frontend, .get_frontend = vidtv_demod_get_frontend, -- 2.43.0