From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0515F372EF0; Sat, 12 Sep 2026 11:53:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789213997; cv=none; b=dCahUX73N86jEFyHTpLQoIX9y7q3x+a9XznssFkkRKr4SUWDAt5naYrISuSa7Uu6heETJ3PdzWOnjHnQb4Te3iFl4oUWTKtueRXBGETrW3dN84awGzAN8gEyG+FonF5zUBkdQifGQIaw9LHvhgZOR7ZMhxOpUr0cZQbg0rB6F2g= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789213997; c=relaxed/simple; bh=pczjrQSIgJcoHHo24SxABxz1NwLCArKB5aBpqt1uaG0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=FDOFODkwatdYV1mVUHdYwBWfexG2oTEAd8v9AoONJOU3M3dBQNF2bWR2h8gGEHvogpin1S7fAE1ijNlWnMbzD5k7ywJVwDLzOf3d2Ryh4ppazvfYeL4v2WH84q2Xw2AbGGB86tM1bSZdwkXc0DHEqdua+f5JLRBlDqNv5gjKCDg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=KQG97Rup; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="KQG97Rup" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DFB4F1F000FF; Sat, 12 Sep 2026 11:53:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789213992; bh=CmwSHNWdyEcBiI5Rkw5fEgS38M0DFug410pwcbvQCME=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=KQG97RupxppRuivl+G8hNS5F6wvcJTPwJdT8UTyixvxmMh9u4/cRN8hpEusN1OQPR zCA1wBE/W8uFI+rKOlRH3IKgdcoBatGbEXinKzUoirrFFwxiO/3rHMNBkGHzOB+6F/ BUw9yR4Viaf/YYNEuCKUGcFFmipCwCMrTwzFq58M= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Shuangpeng Bai , Hans Verkuil Subject: [PATCH 6.12 0192/1376] media: go7007: defer the ALSA v4l2 put until card release Date: Sat, 12 Sep 2026 08:43:38 +0200 Message-ID: <20260912065611.830314467@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260912065607.535295758@linuxfoundation.org> References: <20260912065607.535295758@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Shuangpeng Bai commit 1bd456afeb8a515137e567967069fce6f8fcd23e upstream. go7007_snd_init() already takes a v4l2_device reference for the ALSA side, but go7007_snd_remove() drops it immediately after calling snd_card_free_when_closed(). That is too early when a userspace process still has the capture PCM open. The ALSA card and its PCM callbacks remain alive until the last file is closed, so the release path can still reach struct go7007 through pcm->private_data and call go7007_snd_hw_free() after the V4L2 release path has freed the object. Move the matching v4l2_device_put() to the ALSA card private_free callback so the existing ALSA reference covers the whole deferred card lifetime. Closes: https://lore.kernel.org/r/178144969601.60470.6005237146425573205@gmail.com Fixes: d5d3a7cc127d ("[media] go7007: fix unregister/disconnect handling") Cc: stable@vger.kernel.org Signed-off-by: Shuangpeng Bai Signed-off-by: Hans Verkuil Signed-off-by: Greg Kroah-Hartman --- drivers/media/usb/go7007/snd-go7007.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) --- a/drivers/media/usb/go7007/snd-go7007.c +++ b/drivers/media/usb/go7007/snd-go7007.c @@ -195,6 +195,13 @@ static const struct snd_device_ops go700 .dev_free = go7007_snd_free, }; +static void go7007_snd_card_free(struct snd_card *card) +{ + struct go7007 *go = card->private_data; + + v4l2_device_put(&go->v4l2_dev); +} + int go7007_snd_init(struct go7007 *go) { static int dev; @@ -245,6 +252,8 @@ int go7007_snd_init(struct go7007 *go) gosnd->substream = NULL; go->snd_context = gosnd; v4l2_device_get(&go->v4l2_dev); + gosnd->card->private_data = go; + gosnd->card->private_free = go7007_snd_card_free; ++dev; return 0; @@ -263,7 +272,6 @@ int go7007_snd_remove(struct go7007 *go) snd_card_disconnect(gosnd->card); snd_card_free_when_closed(gosnd->card); - v4l2_device_put(&go->v4l2_dev); return 0; } EXPORT_SYMBOL(go7007_snd_remove);