[PATCH] fix: sound/usb: snd_media_device_create: incorrect media_device_delete on borrowed reference

[WenTao Liang]

In snd_media_device_create(), when chip->media_dev is already set, mdev
borrows the reference without incrementing the refcount. On error paths
through create_fail, media_device_delete() is called which releases the
borrowed reference, corrupting the reference count. Additionally,
chip->media_dev is set to NULL, losing the original reference.

Introduce an 'allocated' flag to distinguish between borrowed and
self-allocated references, and only call media_device_delete() when the
reference was actually acquired by this function invocation.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: 66354f18fe5f ("media: sound/usb: Use Media Controller API to share media resources")
Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>
---
 sound/usb/media.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/sound/usb/media.c b/sound/usb/media.c
index b7497d18ee3f..290bd24bf301 100644
--- a/sound/usb/media.c
+++ b/sound/usb/media.c
@@ -255,6 +255,7 @@ int snd_media_device_create(struct snd_usb_audio *chip,
 	struct media_device *mdev;
 	struct usb_device *usbdev = interface_to_usbdev(iface);
 	int ret = 0;
+	bool allocated = false;
 
 	/* usb-audio driver is probed for each usb interface, and
 	 * there are multiple interfaces per device. Avoid calling
@@ -272,6 +273,7 @@ int snd_media_device_create(struct snd_usb_audio *chip,
 
 	/* save media device - avoid lookups */
 	chip->media_dev = mdev;
+	allocated = true;
 
 snd_mixer_init:
 	/* Create media entities for mixer and control dev */
@@ -292,9 +294,11 @@ int snd_media_device_create(struct snd_usb_audio *chip,
 create_fail:
 		if (ret) {
 			snd_media_mixer_delete(chip);
-			media_device_delete(mdev, KBUILD_MODNAME, THIS_MODULE);
-			/* clear saved media_dev */
-			chip->media_dev = NULL;
+			if (allocated) {
+				media_device_delete(mdev, KBUILD_MODNAME, THIS_MODULE);
+				/* clear saved media_dev */
+				chip->media_dev = NULL;
+			}
 			dev_err(&usbdev->dev,
 				"Couldn't register media device. Error: %d\n",
 				ret);
-- 
2.39.5 (Apple Git-154)