[BUG] media: ttusb-dec: kmemleak reports dvb_frontend_private leak after frontend registration failure

[BUG] media: ttusb-dec: kmemleak reports dvb_frontend_private leak after frontend registration failure

[Shuangpeng]

Hi Kernel Maintainers,

I hit the following kmemleak report while testing current upstream kernel:

kmemleak: unreferenced object in dvb_register_frontend

on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026)

The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/e8dd4867a7b7907c1857ca732e7d56e5

I’m happy to test debug patches or provide additional information.

Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>

unreferenced object 0xffff88816510b000 (size 1024):
comm "kworker/0:0", pid 9129, jiffies 4295084343
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
backtrace (crc 2b918277):
__kmalloc_cache_noprof (./include/linux/kmemleak.h:44 mm/slub.c:4575 mm/slub.c:4899 mm/slub.c:5415)
dvb_register_frontend (./include/linux/slab.h:950 ./include/linux/slab.h:1188 drivers/media/dvb-core/dvb_frontend.c:3024)
ttusb_dec_probe (drivers/media/usb/ttusb-dec/ttusb_dec.c:1695)
usb_probe_interface (drivers/usb/core/driver.c:396)
really_probe (drivers/base/dd.c:? drivers/base/dd.c:709)
__driver_probe_device (drivers/base/dd.c:871)
driver_probe_device (drivers/base/dd.c:901)
__device_attach_driver (drivers/base/dd.c:1029)
bus_for_each_drv (drivers/base/bus.c:500)
__device_attach (drivers/base/dd.c:1101)
device_initial_probe (drivers/base/dd.c:1156)
bus_probe_device (drivers/base/bus.c:613)
device_add (drivers/base/core.c:3706)
usb_set_configuration (drivers/usb/core/message.c:2268)
usb_generic_driver_probe (drivers/usb/core/generic.c:250)
usb_probe_device (drivers/usb/core/driver.c:291)


Best,
Shuangpeng

[PATCH] media: ttusb-dec: detach frontend on registration failure

[Shuangpeng Bai]

ttusb_dec_probe() calls dvb_register_frontend() after attaching the
frontend. If dvb_register_frontend() fails after allocating
fe->frontend_priv, the DVB frontend core has initialized the frontend
refcount and drops only the registration reference before returning.

The remaining detach reference must still be released via
dvb_frontend_detach(). Calling the frontend driver release callback
directly frees the ttusbdecfe state, but bypasses the DVB frontend core
cleanup and leaks struct dvb_frontend_private.

Use dvb_frontend_detach() on frontend registration failure.

Fixes: a574359e2e71 ("media: dvb-core: Fix ignored return value in dvb_register_frontend()")
Closes: https://lore.kernel.org/all/D1EE37E7-8CCB-4621-8105-0229FADF5855@gmail.com/
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
---
 drivers/media/usb/ttusb-dec/ttusb_dec.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c
index 825a3875989d..8566fb074092 100644
--- a/drivers/media/usb/ttusb-dec/ttusb_dec.c
+++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c
@@ -1694,8 +1694,7 @@ static int ttusb_dec_probe(struct usb_interface *intf,
 	} else {
 		if (dvb_register_frontend(&dec->adapter, dec->fe)) {
 			printk("budget-ci: Frontend registration failed!\n");
-			if (dec->fe->ops.release)
-				dec->fe->ops.release(dec->fe);
+			dvb_frontend_detach(dec->fe);
 			dec->fe = NULL;
 		}
 	}
-- 
2.43.0