[PATCH] media: msi2500: free isochronous URBs on disconnect

[raoxu]

From: Xu Rao <raoxu@xxxxxxxxxxxxx>

The problem occurs when an MSi2500 device is unplugged while an
isochronous stream is active. The streaming setup allocates eight URBs
and a 24 KiB coherent transfer buffer for each URB.

On disconnect, msi2500_disconnect() clears dev->udev without releasing
those resources. When vb2 later calls msi2500_stop_streaming(), the
dev->udev check prevents msi2500_isoc_cleanup() from running.

This matters because msi2500_isoc_cleanup() calls msi2500_iso_free(),
which releases each transfer buffer with
usb_free_coherent(dev->udev, ...). Once dev->udev has been cleared, the
normal stop-streaming path can no longer perform that cleanup.

As a result, each unplug while streaming leaks all eight URBs and eight
24 KiB coherent buffers, for a total of 192 KiB of coherent DMA memory.

Run msi2500_isoc_cleanup() from the disconnect callback before clearing
dev->udev. The disconnect path already holds the two locks required by
the cleanup helper, and msi2500_iso_free() clears each URB pointer after
freeing it, so a later cleanup attempt cannot free the resources twice.

Signed-off-by: Xu Rao <raoxu@xxxxxxxxxxxxx>
---
 drivers/media/usb/msi2500/msi2500.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/usb/msi2500/msi2500.c b/drivers/media/usb/msi2500/msi2500.c
index 282256ab812a..88c188d3b001 100644
--- a/drivers/media/usb/msi2500/msi2500.c
+++ b/drivers/media/usb/msi2500/msi2500.c
@@ -572,6 +572,7 @@ static void msi2500_disconnect(struct usb_interface *intf)
 	mutex_lock(&dev->vb_queue_lock);
 	mutex_lock(&dev->v4l2_lock);
 	/* No need to keep the urbs around after disconnection */
+	msi2500_isoc_cleanup(dev);
 	dev->udev = NULL;
 	v4l2_device_disconnect(&dev->v4l2_dev);
 	video_unregister_device(&dev->vdev);
--
2.50.1