[PATCH v3] media: as102: drop device reference on probe failure

[PATCH v3] media: as102: drop device reference on probe failure

[Jiawen Liu]

as102_usb_probe() initializes the kref and takes a USB device reference
before registering the USB minor.

The change named in the Fixes tag avoided freeing as102_dev directly
after usb_register_dev() succeeds, because userspace can open the minor
before a later probe failure and hold an extra kref until release.

However, the stream-allocation and DVB-registration failure paths now
deregister the USB minor and return without dropping the probe path
initial kref. That leaves the USB device reference held by as102_dev
leaked.

Drop the initial reference with kref_put() after usb_deregister_dev(). If
no userspace file is open, as102_usb_release() releases the USB device
and frees as102_dev immediately. If a file is open, the final free is
deferred until the last file release drops the remaining kref.

Fixes: 8bd29dbe03fc ("media: as102: fix to not free memory after the device is registered in as102_usb_probe()")
Cc: stable@vger.kernel.org
Signed-off-by: Jiawen Liu <1298662399@qq.com>
---
Changes in v3:
- Collapse the error labels so failed_stream falls through to the common
  kref_put() return path, as suggested by Bryan O'Donoghue.

Changes in v2:
- Add Fixes and Cc stable tags.
- Clarify why the probe failure path must drop the initial kref rather
  than free as102_dev directly.

 drivers/media/usb/as102/as102_usb_drv.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/media/usb/as102/as102_usb_drv.c b/drivers/media/usb/as102/as102_usb_drv.c
index a11024451ceb..2e6c9b50ee5f 100644
--- a/drivers/media/usb/as102/as102_usb_drv.c
+++ b/drivers/media/usb/as102/as102_usb_drv.c
@@ -403,13 +403,10 @@ static int as102_usb_probe(struct usb_interface *intf,
 failed_dvb:
 	as102_free_usb_stream_buffer(as102_dev);
 failed_stream:
-	usb_set_intfdata(intf, NULL);
 	usb_deregister_dev(intf, &as102_usb_class_driver);
-	return ret;
 failed:
-	usb_put_dev(as102_dev->bus_adap.usb_dev);
 	usb_set_intfdata(intf, NULL);
-	kfree(as102_dev);
+	kref_put(&as102_dev->kref, as102_usb_release);
 	return ret;
 }
 

base-commit: 9e7e6633458362db72427b48effad8d759131c35
-- 
2.34.1

Re: [PATCH v3] media: as102: drop device reference on probe failure

[Bryan O'Donoghue]

On 23/06/2026 09:56, Jiawen Liu wrote:
> as102_usb_probe() initializes the kref and takes a USB device reference
> before registering the USB minor.
> 
> The change named in the Fixes tag avoided freeing as102_dev directly
> after usb_register_dev() succeeds, because userspace can open the minor
> before a later probe failure and hold an extra kref until release.
> 
> However, the stream-allocation and DVB-registration failure paths now
> deregister the USB minor and return without dropping the probe path
> initial kref. That leaves the USB device reference held by as102_dev
> leaked.
> 
> Drop the initial reference with kref_put() after usb_deregister_dev(). If
> no userspace file is open, as102_usb_release() releases the USB device
> and frees as102_dev immediately. If a file is open, the final free is
> deferred until the last file release drops the remaining kref.
> 
> Fixes: 8bd29dbe03fc ("media: as102: fix to not free memory after the device is registered in as102_usb_probe()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiawen Liu <1298662399@qq.com>
> ---
> Changes in v3:
> - Collapse the error labels so failed_stream falls through to the common
>    kref_put() return path, as suggested by Bryan O'Donoghue.
> 
> Changes in v2:
> - Add Fixes and Cc stable tags.
> - Clarify why the probe failure path must drop the initial kref rather
>    than free as102_dev directly.
> 
>   drivers/media/usb/as102/as102_usb_drv.c | 5 +----
>   1 file changed, 1 insertion(+), 4 deletions(-)
> 
> diff --git a/drivers/media/usb/as102/as102_usb_drv.c b/drivers/media/usb/as102/as102_usb_drv.c
> index a11024451ceb..2e6c9b50ee5f 100644
> --- a/drivers/media/usb/as102/as102_usb_drv.c
> +++ b/drivers/media/usb/as102/as102_usb_drv.c
> @@ -403,13 +403,10 @@ static int as102_usb_probe(struct usb_interface *intf,
>   failed_dvb:
>   	as102_free_usb_stream_buffer(as102_dev);
>   failed_stream:
> -	usb_set_intfdata(intf, NULL);
>   	usb_deregister_dev(intf, &as102_usb_class_driver);
> -	return ret;
>   failed:
> -	usb_put_dev(as102_dev->bus_adap.usb_dev);
>   	usb_set_intfdata(intf, NULL);
> -	kfree(as102_dev);
> +	kref_put(&as102_dev->kref, as102_usb_release);
>   	return ret;
>   }
> 
> 
> base-commit: 9e7e6633458362db72427b48effad8d759131c35
> --
> 2.34.1
> 

Reviewed-by: Bryan O'Donoghue <bod@kernel.org>

---
bod