[PATCH 1/3] media: siano: Fix potential use-after-free on graph failure

[Guangshuo Li]

If dvb_create_media_graph() fails, the core client remains registered
with a context that is freed by the error path. Subsequent core device
teardown calls smsdvb_onremove() with this stale context.

Unregister the core client before freeing its context. Leave the media
device to the transport on hotplug failure, since the USB probe error
path also releases it.

This issue was found by our static analysis tool under development.

Fixes: 0d3ab8410dcb ("[media] dvb core: must check dvb_create_media_graph()")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: OpenAI:gpt-6-astra
Signed-off-by: Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx>
---
Build-tested the changed object with x86_64 allmodconfig.
No runtime or fault-injection testing was performed.

 drivers/media/common/siano/smsdvb-main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/common/siano/smsdvb-main.c b/drivers/media/common/siano/smsdvb-main.c
index 415c24fbbb65..664868627bf5 100644
--- a/drivers/media/common/siano/smsdvb-main.c
+++ b/drivers/media/common/siano/smsdvb-main.c
@@ -1217,6 +1217,7 @@ static int smsdvb_hotplug(struct smscore_device_t *coredev,
 	mutex_unlock(&g_smsdvb_clientslock);
 
 	smsdvb_debugfs_release(client);
+	smscore_unregister_client(client->smsclient);
 
 client_error:
 	dvb_unregister_frontend(&client->frontend);
@@ -1228,7 +1229,6 @@ static int smsdvb_hotplug(struct smscore_device_t *coredev,
 	dvb_dmx_release(&client->demux);
 
 dvbdmx_error:
-	smsdvb_media_device_unregister(client);
 	dvb_unregister_adapter(&client->adapter);
 
 adapter_error: