[PATCH 0/3] media: Fix potential lifetime errors in probe rollback

[PATCH 0/3] media: Fix potential lifetime errors in probe rollback

[Guangshuo Li]

Unregister a Siano client before freeing its context, and avoid freeing
ALSA private data twice in cx18 and ivtv.

The changed driver objects were build-tested. No hardware testing was
performed.

Guangshuo Li (3):
  media: siano: Fix potential use-after-free on graph failure
  media: cx18: Fix potential double free on ALSA initialization failure
  media: ivtv: Fix potential double free on ALSA initialization failure

 drivers/media/common/siano/smsdvb-main.c | 2 +-
 drivers/media/pci/cx18/cx18-alsa-main.c  | 1 -
 drivers/media/pci/ivtv/ivtv-alsa-main.c  | 1 -
 3 files changed, 1 insertion(+), 3 deletions(-)


base-commit: d89e1d186ec9271bf78e62771779e9fc03bf0fc3

[PATCH 1/3] media: siano: Fix potential use-after-free on graph failure

[Guangshuo Li]

If dvb_create_media_graph() fails, the core client remains registered
with a context that is freed by the error path. Subsequent core device
teardown calls smsdvb_onremove() with this stale context.

Unregister the core client before freeing its context. Leave the media
device to the transport on hotplug failure, since the USB probe error
path also releases it.

This issue was found by our static analysis tool under development.

Fixes: 0d3ab8410dcb ("[media] dvb core: must check dvb_create_media_graph()")
Cc: stable@vger.kernel.org
Assisted-by: OpenAI:gpt-6-astra
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
Build-tested the changed object with x86_64 allmodconfig.
No runtime or fault-injection testing was performed.

 drivers/media/common/siano/smsdvb-main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/common/siano/smsdvb-main.c b/drivers/media/common/siano/smsdvb-main.c
index 415c24fbbb65..664868627bf5 100644
--- a/drivers/media/common/siano/smsdvb-main.c
+++ b/drivers/media/common/siano/smsdvb-main.c
@@ -1217,6 +1217,7 @@ static int smsdvb_hotplug(struct smscore_device_t *coredev,
 	mutex_unlock(&g_smsdvb_clientslock);
 
 	smsdvb_debugfs_release(client);
+	smscore_unregister_client(client->smsclient);
 
 client_error:
 	dvb_unregister_frontend(&client->frontend);
@@ -1228,7 +1229,6 @@ static int smsdvb_hotplug(struct smscore_device_t *coredev,
 	dvb_dmx_release(&client->demux);
 
 dvbdmx_error:
-	smsdvb_media_device_unregister(client);
 	dvb_unregister_adapter(&client->adapter);
 
 adapter_error:

[PATCH 2/3] media: cx18: Fix potential double free on ALSA initialization failure

[Guangshuo Li]

After snd_cx18_card_create() succeeds, the card's private_free callback
owns cxsc. snd_card_free() already invokes that callback on subsequent
initialization failures, so the explicit kfree() frees cxsc twice.

Remove the redundant free.

This issue was found by our static analysis tool under development.

Fixes: 2c87d9db46d1 ("[media] drivers/media/video: fix memory leak of snd_cx18_init()")
Cc: stable@vger.kernel.org
Assisted-by: OpenAI:gpt-6-astra
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
Build-tested the changed object with x86_64 allmodconfig.
No runtime or fault-injection testing was performed.

 drivers/media/pci/cx18/cx18-alsa-main.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/media/pci/cx18/cx18-alsa-main.c b/drivers/media/pci/cx18/cx18-alsa-main.c
index b77f5375f3ff..7fe538621d4e 100644
--- a/drivers/media/pci/cx18/cx18-alsa-main.c
+++ b/drivers/media/pci/cx18/cx18-alsa-main.c
@@ -171,7 +171,6 @@ static int snd_cx18_init(struct v4l2_device *v4l2_dev)
 err_exit_free:
 	if (sc != NULL)
 		snd_card_free(sc);
-	kfree(cxsc);
 err_exit:
 	return ret;
 }

[PATCH 3/3] media: ivtv: Fix potential double free on ALSA initialization failure

[Guangshuo Li]

After snd_ivtv_card_create() succeeds, the card's private_free callback
owns itvsc. snd_card_free() already invokes that callback on subsequent
initialization failures, so the explicit kfree() frees itvsc twice.

Remove the redundant free.

This issue was found by our static analysis tool under development.

Fixes: 269c11fbac4f ("[media] ivtv, ivtv-alsa: Add initial ivtv-alsa interface driver for ivtv")
Cc: stable@vger.kernel.org
Assisted-by: OpenAI:gpt-6-astra
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
Build-tested the changed object with x86_64 allmodconfig.
No runtime or fault-injection testing was performed.

 drivers/media/pci/ivtv/ivtv-alsa-main.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/media/pci/ivtv/ivtv-alsa-main.c b/drivers/media/pci/ivtv/ivtv-alsa-main.c
index 59573debd19e..e06f194c0765 100644
--- a/drivers/media/pci/ivtv/ivtv-alsa-main.c
+++ b/drivers/media/pci/ivtv/ivtv-alsa-main.c
@@ -173,7 +173,6 @@ static int snd_ivtv_init(struct v4l2_device *v4l2_dev)
 err_exit_free:
 	if (sc != NULL)
 		snd_card_free(sc);
-	kfree(itvsc);
 err_exit:
 	return ret;
 }