[BUG] media: as102: kmemleak reports two leaks after dvb_register_frontend() failure

[BUG] media: as102: kmemleak reports two leaks after dvb_register_frontend() failure

[Shuangpeng]

Hi Kernel Maintainers,

I hit the following kmemleak reports while testing current upstream kernel:

kmemleak: unreferenced object in as102_usb_probe
kmemleak: unreferenced object in as102_attach

on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026)

The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/f122f8acb8a9e4b9ed08d6a76dd5eb79

I’m happy to test debug patches or provide additional information.

Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>

unreferenced object 0xffff88811641a000 (size 4096):
comm "kworker/1:1", pid 30, jiffies 4295053869
hex dump (first 32 bytes):
40 b3 2a 8b ff ff ff ff 00 70 47 66 81 88 ff ff  @.*......pGf....
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
backtrace (crc 52c16f09):
__kmalloc_cache_noprof (./include/linux/kmemleak.h:44 mm/slub.c:4575 mm/slub.c:4899 mm/slub.c:5415)
as102_usb_probe (./include/linux/slab.h:950 ./include/linux/slab.h:1188 drivers/media/usb/as102/as102_usb_drv.c:348)
usb_probe_interface (drivers/usb/core/driver.c:396)
really_probe (drivers/base/dd.c:? drivers/base/dd.c:709)
__driver_probe_device (drivers/base/dd.c:871)
driver_probe_device (drivers/base/dd.c:901)
__device_attach_driver (drivers/base/dd.c:1029)
bus_for_each_drv (drivers/base/bus.c:500)
__device_attach (drivers/base/dd.c:1101)
device_initial_probe (drivers/base/dd.c:1156)
bus_probe_device (drivers/base/bus.c:613)
device_add (drivers/base/core.c:3706)
usb_set_configuration (drivers/usb/core/message.c:2268)
usb_generic_driver_probe (drivers/usb/core/generic.c:250)
usb_probe_device (drivers/usb/core/driver.c:291)
really_probe (drivers/base/dd.c:? drivers/base/dd.c:709)

unreferenced object 0xffff888166471000 (size 2048):
comm "kworker/1:1", pid 30, jiffies 4295053870
hex dump (first 32 bytes):
01 00 00 00 00 00 00 00 41 62 69 6c 69 73 20 53  ........Abilis S
79 73 74 65 6d 73 20 44 56 42 2d 54 69 74 61 6e  ystems DVB-Titan
backtrace (crc f72415e5):
__kmalloc_cache_noprof (./include/linux/kmemleak.h:44 mm/slub.c:4575 mm/slub.c:4899 mm/slub.c:5415)
as102_attach (./include/linux/slab.h:950 ./include/linux/slab.h:1188 drivers/media/dvb-frontends/as102_fe.c:450)
as102_dvb_register (drivers/media/usb/as102/as102_drv.c:326)
as102_usb_probe (drivers/media/usb/as102/as102_usb_drv.c:397)
usb_probe_interface (drivers/usb/core/driver.c:396)
really_probe (drivers/base/dd.c:? drivers/base/dd.c:709)
__driver_probe_device (drivers/base/dd.c:871)
driver_probe_device (drivers/base/dd.c:901)
__device_attach_driver (drivers/base/dd.c:1029)
bus_for_each_drv (drivers/base/bus.c:500)
__device_attach (drivers/base/dd.c:1101)
device_initial_probe (drivers/base/dd.c:1156)
bus_probe_device (drivers/base/bus.c:613)
device_add (drivers/base/core.c:3706)
usb_set_configuration (drivers/usb/core/message.c:2268)
usb_generic_driver_probe (drivers/usb/core/generic.c:250)

Best,
Shuangpeng

[PATCH 1/2] media: as102: fix memory leak in probe error path after device registration

[xiaopeitux]

From: Pei Xiao <xiaopei01@kylinos.cn>

Commit 8bd29dbe03fc ("media: as102: fix to not free memory after the
device is registered in as102_usb_probe()") solved a use-after-free /
double-free race condition by never freeing as102_dev directly once
usb_register_dev() had succeeded.  Instead, the memory is freed in
as102_usb_release() when the last open file descriptor is closed.

However, this introduced a memory leak when the probe fails after
usb_register_dev() succeeds but no userspace process has opened the
device node.  In that scenario, usb_deregister_dev() removes the device
node, but as102_dev is never freed because as102_usb_release() is never
called (there is no open fd).  The only reference to the object (the
interface's private data) is cleared, leaving the allocated memory
completely unreachable.

Fix the leak by calling kref_put() on as102_dev->kref in the
failed_stream error path.  The kref was initialised to 1 during probe,
and as102_usb_release() is the release function that performs kfree().
If no open fd exists, the kref_put() will drop the initial reference to
zero and trigger as102_usb_release() immediately, freeing the memory.
If there are open fds, the extra references keep the object alive until
the last close, which is the correct behaviour.

Fixes: 8bd29dbe03fc ("media: as102: fix to not free memory after the device is registered in as102_usb_probe()")
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Closes: https://lore.kernel.org/lkml/DAD7161C-A1DA-422E-BBC5-2893ABDC2DD0@gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
---
 drivers/media/usb/as102/as102_usb_drv.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/usb/as102/as102_usb_drv.c b/drivers/media/usb/as102/as102_usb_drv.c
index a11024451ceb..ad6c5837f1d7 100644
--- a/drivers/media/usb/as102/as102_usb_drv.c
+++ b/drivers/media/usb/as102/as102_usb_drv.c
@@ -405,6 +405,7 @@ static int as102_usb_probe(struct usb_interface *intf,
 failed_stream:
 	usb_set_intfdata(intf, NULL);
 	usb_deregister_dev(intf, &as102_usb_class_driver);
+	kref_put(&as102_dev->kref, as102_usb_release);
 	return ret;
 failed:
 	usb_put_dev(as102_dev->bus_adap.usb_dev);
-- 
2.25.1