[PATCH v2] media: as102: drop device reference on probe failure

[Jiawen Liu]

as102_usb_probe() initializes the kref and takes a USB device reference
before registering the USB minor.

The change named in the Fixes tag avoided freeing as102_dev directly
after usb_register_dev() succeeds, because userspace can open the minor
before a later probe failure and hold an extra kref until release.

However, the stream-allocation and DVB-registration failure paths now
deregister the USB minor and return without dropping the probe path
initial kref. That leaves the USB device reference held by as102_dev
leaked.

Drop the initial reference with kref_put() after usb_deregister_dev(). If
no userspace file is open, as102_usb_release() releases the USB device
and frees as102_dev immediately. If a file is open, the final free is
deferred until the last file release drops the remaining kref.

Fixes: 8bd29dbe03fc ("media: as102: fix to not free memory after the device is registered in as102_usb_probe()")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jiawen Liu <1298662399@xxxxxx>
---
 drivers/media/usb/as102/as102_usb_drv.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/usb/as102/as102_usb_drv.c b/drivers/media/usb/as102/as102_usb_drv.c
index a11024451ceb..ad6c5837f1d7 100644
--- a/drivers/media/usb/as102/as102_usb_drv.c
+++ b/drivers/media/usb/as102/as102_usb_drv.c
@@ -405,6 +405,7 @@ static int as102_usb_probe(struct usb_interface *intf,
 failed_stream:
 	usb_set_intfdata(intf, NULL);
 	usb_deregister_dev(intf, &as102_usb_class_driver);
+	kref_put(&as102_dev->kref, as102_usb_release);
 	return ret;
 failed:
 	usb_put_dev(as102_dev->bus_adap.usb_dev);

base-commit: 9e7e6633458362db72427b48effad8d759131c35
-- 
2.34.1