[PATCH] fix: sound/usb: snd_media_device_create: incorrect media_device_delete on borrowed reference

[PATCH] fix: sound/usb: snd_media_device_create: incorrect media_device_delete on borrowed reference

[WenTao Liang]

In snd_media_device_create(), when chip->media_dev is already set, mdev
borrows the reference without incrementing the refcount. On error paths
through create_fail, media_device_delete() is called which releases the
borrowed reference, corrupting the reference count. Additionally,
chip->media_dev is set to NULL, losing the original reference.

Introduce an 'allocated' flag to distinguish between borrowed and
self-allocated references, and only call media_device_delete() when the
reference was actually acquired by this function invocation.

Cc: stable@vger.kernel.org
Fixes: 66354f18fe5f ("media: sound/usb: Use Media Controller API to share media resources")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
 sound/usb/media.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/sound/usb/media.c b/sound/usb/media.c
index b7497d18ee3f..290bd24bf301 100644
--- a/sound/usb/media.c
+++ b/sound/usb/media.c
@@ -255,6 +255,7 @@ int snd_media_device_create(struct snd_usb_audio *chip,
 	struct media_device *mdev;
 	struct usb_device *usbdev = interface_to_usbdev(iface);
 	int ret = 0;
+	bool allocated = false;
 
 	/* usb-audio driver is probed for each usb interface, and
 	 * there are multiple interfaces per device. Avoid calling
@@ -272,6 +273,7 @@ int snd_media_device_create(struct snd_usb_audio *chip,
 
 	/* save media device - avoid lookups */
 	chip->media_dev = mdev;
+	allocated = true;
 
 snd_mixer_init:
 	/* Create media entities for mixer and control dev */
@@ -292,9 +294,11 @@ int snd_media_device_create(struct snd_usb_audio *chip,
 create_fail:
 		if (ret) {
 			snd_media_mixer_delete(chip);
-			media_device_delete(mdev, KBUILD_MODNAME, THIS_MODULE);
-			/* clear saved media_dev */
-			chip->media_dev = NULL;
+			if (allocated) {
+				media_device_delete(mdev, KBUILD_MODNAME, THIS_MODULE);
+				/* clear saved media_dev */
+				chip->media_dev = NULL;
+			}
 			dev_err(&usbdev->dev,
 				"Couldn't register media device. Error: %d\n",
 				ret);
-- 
2.39.5 (Apple Git-154)

Re: [PATCH] fix: sound/usb: snd_media_device_create: incorrect media_device_delete on borrowed reference

[Takashi Iwai]

On Sat, 27 Jun 2026 06:09:07 +0200,
WenTao Liang wrote:
> 
> In snd_media_device_create(), when chip->media_dev is already set, mdev
> borrows the reference without incrementing the refcount. On error paths
> through create_fail, media_device_delete() is called which releases the
> borrowed reference, corrupting the reference count. Additionally,
> chip->media_dev is set to NULL, losing the original reference.
> 
> Introduce an 'allocated' flag to distinguish between borrowed and
> self-allocated references, and only call media_device_delete() when the
> reference was actually acquired by this function invocation.

Does this really happen?  The code in question is after the check by
media_devnode_is_registered(), and if chip->media_dev has been already
set, it means that it should have been already registered, hence this
code path won't hit.


thanks,

Takashi


> 
> Cc: stable@vger.kernel.org
> Fixes: 66354f18fe5f ("media: sound/usb: Use Media Controller API to share media resources")
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
> ---
>  sound/usb/media.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
> 
> diff --git a/sound/usb/media.c b/sound/usb/media.c
> index b7497d18ee3f..290bd24bf301 100644
> --- a/sound/usb/media.c
> +++ b/sound/usb/media.c
> @@ -255,6 +255,7 @@ int snd_media_device_create(struct snd_usb_audio *chip,
>  	struct media_device *mdev;
>  	struct usb_device *usbdev = interface_to_usbdev(iface);
>  	int ret = 0;
> +	bool allocated = false;
>  
>  	/* usb-audio driver is probed for each usb interface, and
>  	 * there are multiple interfaces per device. Avoid calling
> @@ -272,6 +273,7 @@ int snd_media_device_create(struct snd_usb_audio *chip,
>  
>  	/* save media device - avoid lookups */
>  	chip->media_dev = mdev;
> +	allocated = true;
>  
>  snd_mixer_init:
>  	/* Create media entities for mixer and control dev */
> @@ -292,9 +294,11 @@ int snd_media_device_create(struct snd_usb_audio *chip,
>  create_fail:
>  		if (ret) {
>  			snd_media_mixer_delete(chip);
> -			media_device_delete(mdev, KBUILD_MODNAME, THIS_MODULE);
> -			/* clear saved media_dev */
> -			chip->media_dev = NULL;
> +			if (allocated) {
> +				media_device_delete(mdev, KBUILD_MODNAME, THIS_MODULE);
> +				/* clear saved media_dev */
> +				chip->media_dev = NULL;
> +			}
>  			dev_err(&usbdev->dev,
>  				"Couldn't register media device. Error: %d\n",
>  				ret);
> -- 
> 2.39.5 (Apple Git-154)
>