Re: [PATCH 3/3] media: em28xx: fix refcount underflow in em28xx_free_v4l2()

[Hans Verkuil <hverkuil+cisco@kernel.org>]

On 22/10/2026 21:49, Nguyen Duy Nhat Anh wrote:
> em28xx_free_v4l2() is registered as the v4l2_dev release callback, invoked
> when v4l2_dev's reference count drops to zero.
> 
> Calling v4l2_device_unregister() from inside this callback causes an extra
> call to v4l2_device_put() on a zero reference count, triggering a refcount_t
> underflow (0 -> -1) and a kernel BUG in lib/refcount.c.

Huh? v4l2_device_unregister doesn't call v4l2_device_put AFAICS.

This doesn't sounds right.

Regards,

	Hans

> 
> Fix this by removing v4l2_device_unregister() from em28xx_free_v4l2() and
> calling it in em28xx_v4l2_fini() during teardown instead.
> 
> Reported-by: syzbot+809dfc586f33fc44b6ac@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=809dfc586f33fc44b6ac
> Signed-off-by: Nguyen Duy Nhat Anh <neganhat@gmail.com>
> ---
>  drivers/media/usb/em28xx/em28xx-video.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
> index d653341ffd16..45b62655ca3b 100644
> --- a/drivers/media/usb/em28xx/em28xx-video.c
> +++ b/drivers/media/usb/em28xx/em28xx-video.c
> @@ -2332,7 +2332,6 @@ static void em28xx_free_v4l2(struct v4l2_device *v4l2_dev)
>  	struct em28xx *dev = v4l2->dev;
>  
>  	v4l2_ctrl_handler_free(&v4l2->ctrl_handler);
> -	v4l2_device_unregister(v4l2_dev);
>  	dev->v4l2 = NULL;
>  	kfree(v4l2);
>  	kref_put(&dev->ref, em28xx_free_device);
> @@ -2462,7 +2461,7 @@ static int em28xx_v4l2_fini(struct em28xx *dev)
>  	 * The em28xx_free_v4l2() release callback will be invoked once all
>  	 * userspace file handles to the video device nodes are closed.
>  	 */
> -	v4l2_device_put(&v4l2->v4l2_dev);
> +	v4l2_device_unregister(&v4l2->v4l2_dev);
>  
>  	return 0;
>  }