mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-30 20:30:26 -04:00
Code Issues Packages Projects Releases Wiki Activity

media: usbtv: Fix V4L2 refcount leak on probe failure

Browse Source 
usbtv_probe() allocates usbtv before usbtv_video_init() registers its
embedded v4l2_device. v4l2_device_register() initializes the reference
count to one, with usbtv_release() providing the final cleanup.

If video_register_device() fails, usbtv_video_init() unregisters the
V4L2 device and returns an error without dropping the initial
v4l2_device reference. The probe error path then calls kfree() on usbtv
directly, leaving the reference stranded and bypassing
usbtv_release().

Leave the initialized V4L2 device intact on this failure path. After
releasing the USB reference, call v4l2_device_put() so the final
reference invokes usbtv_release(). Retain the direct kfree() path for
failures that occur before v4l2_device_register().

This issue was found by a static analysis tool I am developing.

Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
This commit is contained in:
Guangshuo Li
2026-07-14 23:16:48 +08:00
committed by Hans Verkuil
parent 0735e0b5a9
commit bbd4218310
2 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/media/usb/usbtv/usbtv-core.c
View File

@@ -119,7 +119,10 @@ static int usbtv_probe(struct usb_interface *intf,
usbtv_video_fail:
usb_set_intfdata(intf, NULL);
kfree(usbtv);
if (usbtv->v4l2_dev.dev)
v4l2_device_put(&usbtv->v4l2_dev);
else
kfree(usbtv);
return ret;
}

4
drivers/media/usb/usbtv/usbtv-video.c
View File

@@ -949,13 +949,11 @@ int usbtv_video_init(struct usbtv *usbtv)
ret = video_register_device(&usbtv->vdev, VFL_TYPE_VIDEO, -1);
if (ret < 0) {
dev_warn(usbtv->dev, "Could not register video device\n");
goto vdev_fail;
return ret;
}
return 0;
vdev_fail:
v4l2_device_unregister(&usbtv->v4l2_dev);
v4l2_fail:
ctrl_fail:
v4l2_ctrl_handler_free(&usbtv->ctrl);