Re: [PATCH] media: gspca: hold a usb_device reference while registered

[Hans Verkuil]

On 18/07/2026 04:54, Shuangpeng Bai wrote:
> gspca keeps a pointer to the probed struct usb_device in
> gspca_dev->dev, but it does not hold a reference to it. The
> V4L2/video-device reference can keep the outer gspca_dev alive after USB
> disconnect, and the streaming queue can then be canceled from the last
> file release path.
> 
> That late release path still calls into gspca_stream_off(), which may
> call sub-driver stop callbacks or usb_set_interface() and dereference
> gspca_dev->dev after the USB core has freed the device.
> 
> Take a reference to the usb_device when storing it in gspca_dev and drop
> it from the final gspca_release() path. Balance the reference in the
> probe error path as well.
> 
> Fixes: 63eb9546dcb5 ("V4L/DVB (8152): Initial release of gspca with only one driver.")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@xxxxxxxxx>
> ---
>  drivers/media/usb/gspca/gspca.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspca.c
> index 594d73e50b9f..59eb4cec1aed 100644
> --- a/drivers/media/usb/gspca/gspca.c
> +++ b/drivers/media/usb/gspca/gspca.c
> @@ -1178,6 +1178,7 @@ static void gspca_release(struct v4l2_device *v4l2_device)
>  	v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler);
>  	v4l2_device_unregister(&gspca_dev->v4l2_dev);
>  	kfree(gspca_dev->usb_buf);
> +	usb_put_dev(gspca_dev->dev);
>  	kfree(gspca_dev);
>  }
>  
> @@ -1462,7 +1463,7 @@ int gspca_dev_probe2(struct usb_interface *intf,
>  		ret = -ENOMEM;
>  		goto out;
>  	}
> -	gspca_dev->dev = dev;
> +	gspca_dev->dev = usb_get_dev(dev);
>  	gspca_dev->iface = intf->cur_altsetting->desc.bInterfaceNumber;
>  	gspca_dev->xfer_ep = -1;
>  
> @@ -1574,6 +1575,7 @@ int gspca_dev_probe2(struct usb_interface *intf,
>  	if (sd_desc->probe_error)
>  		sd_desc->probe_error(gspca_dev);
>  	kfree(gspca_dev->usb_buf);
> +	usb_put_dev(gspca_dev->dev);
>  	kfree(gspca_dev);
>  	return ret;
>  }

Actually, the better solution is to replace v4l2_device_unregister()
by vb2_v4l2_device_unregister() in gspca_disconnect. That ensures that the
queue is canceled at disconnect time.

Regards,

	Hans