[PATCH] media: em28xx: fix audio extension ref leak

[PATCH] media: em28xx: fix audio extension ref leak

[Shuangpeng Bai]

em28xx_audio_init() takes a reference on the em28xx device before
creating and registering the ALSA card. If snd_card_new(),
snd_pcm_new(), audio URB setup, or snd_card_register() fails, the
function returns an error without dropping the reference.

The em28xx extension framework ignores init callback errors, so the
failing init path must balance the reference itself.

Drop the reference on every audio init error path. Only store the ALSA
card in the audio extension after the card is registered successfully,
so em28xx_audio_fini() can use that pointer as the success marker. This
avoids a second put during disconnect or module unload after init has
already failed and dropped the reference.

Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
---
 drivers/media/usb/em28xx/em28xx-audio.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/media/usb/em28xx/em28xx-audio.c b/drivers/media/usb/em28xx/em28xx-audio.c
index ccff6be5599e..f583837f9a85 100644
--- a/drivers/media/usb/em28xx/em28xx-audio.c
+++ b/drivers/media/usb/em28xx/em28xx-audio.c
@@ -829,10 +829,9 @@ static int em28xx_audio_init(struct em28xx *dev)
 	err = snd_card_new(&dev->intf->dev, index[devnr], "Em28xx Audio",
 			   THIS_MODULE, 0, &card);
 	if (err < 0)
-		return err;
+		goto ref_put;
 
 	spin_lock_init(&adev->slock);
-	adev->sndcard = card;
 	adev->udev = udev;
 
 	err = snd_pcm_new(card, "Em28xx Audio", 0, 0, 1, &pcm);
@@ -875,6 +874,8 @@ static int em28xx_audio_init(struct em28xx *dev)
 	if (err < 0)
 		goto urb_free;
 
+	adev->sndcard = card;
+
 	dev_info(&dev->intf->dev, "Audio extension successfully initialized\n");
 	return 0;
 
@@ -883,7 +884,9 @@ static int em28xx_audio_init(struct em28xx *dev)
 
 card_free:
 	snd_card_free(card);
-	adev->sndcard = NULL;
+
+ref_put:
+	kref_put(&dev->ref, em28xx_free_device);
 
 	return err;
 }
@@ -912,9 +915,9 @@ static int em28xx_audio_fini(struct em28xx *dev)
 
 		snd_card_free(dev->adev.sndcard);
 		dev->adev.sndcard = NULL;
-	}
 
-	kref_put(&dev->ref, em28xx_free_device);
+		kref_put(&dev->ref, em28xx_free_device);
+	}
 	return 0;
 }
 
-- 
2.43.0