[PATCH] media: rtl2832_sdr: free DMA stream buffers before clearing udev on remove

[PATCH] media: rtl2832_sdr: free DMA stream buffers before clearing udev on remove

[Valery Borovsky]

rtl2832_sdr_remove() runs on USB disconnect and immediately clears
dev->udev to NULL before any pending streaming teardown can run. When
the user-space application later closes its file descriptor, vb2 calls
rtl2832_sdr_stop_streaming() which in turn calls
rtl2832_sdr_free_stream_bufs(). That helper releases each coherent
buffer with:

    usb_free_coherent(dev->udev, dev->buf_size,
                      dev->buf_list[dev->buf_num],
                      dev->dma_addr[dev->buf_num]);

usb_free_coherent() returns immediately when its dev argument is NULL,
so every DMA stream buffer that was live at disconnect is silently
leaked. The URBs allocated in rtl2832_sdr_alloc_urbs() outlive the
device for the same reason.

Tear down the streaming state in rtl2832_sdr_remove() while dev->udev
is still valid: call rtl2832_sdr_kill_urbs(), rtl2832_sdr_free_urbs()
and rtl2832_sdr_free_stream_bufs() before zeroing dev->udev. The
helpers are idempotent (they clear urbs_submitted, urbs_initialized
and the URB_BUF flag), so the subsequent stop_streaming() path from
the vb2 release sequence becomes a safe no-op.

Issue identified by automated review of the INV-003 series at
https://sashiko.dev/

Fixes: 771138920eaf ("[media] rtl2832_sdr: Realtek RTL2832 SDR driver module")
Cc: stable@vger.kernel.org
Signed-off-by: Valery Borovsky <vebohr@gmail.com>
---
 drivers/media/dvb-frontends/rtl2832_sdr.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/media/dvb-frontends/rtl2832_sdr.c b/drivers/media/dvb-frontends/rtl2832_sdr.c
index 422d1a7b5456..817d91faa598 100644
--- a/drivers/media/dvb-frontends/rtl2832_sdr.c
+++ b/drivers/media/dvb-frontends/rtl2832_sdr.c
@@ -1470,6 +1470,14 @@ static void rtl2832_sdr_remove(struct platform_device *pdev)
 
 	mutex_lock(&dev->vb_queue_lock);
 	mutex_lock(&dev->v4l2_lock);
+	/*
+	 * Release URBs and coherent DMA stream buffers while dev->udev
+	 * is still valid; once it is cleared, usb_free_coherent() silently
+	 * returns and any later stop_streaming() leaks the DMA memory.
+	 */
+	rtl2832_sdr_kill_urbs(dev);
+	rtl2832_sdr_free_urbs(dev);
+	rtl2832_sdr_free_stream_bufs(dev);
 	/* No need to keep the urbs around after disconnection */
 	dev->udev = NULL;
 	v4l2_device_disconnect(&dev->v4l2_dev);
-- 
2.51.0