[PATCH] media: cxusb: fix URB leak on start-streaming error

[Wentao Liang]

When the allocation of a stream buffer fails while fewer than two URBs
have been allocated, the error path jumps to ret_freeab.  That label
only releases the shared auxiliary buffer, so the URBs and their
transfer buffers already stored in cxdev->streamurbs[] are left behind.

At least one URB can be allocated on this path, and vb2 does not call
stop_streaming after start_streaming fails, so nothing else releases
them.

Jump to ret_freeu instead, which frees the URBs before releasing the
auxiliary buffer.  It is also safe when no URB has been allocated yet.

Fixes: e478d4054054 ("media: cxusb: add analog mode support for Medion MD95700")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/media/usb/dvb-usb/cxusb-analog.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/media/usb/dvb-usb/cxusb-analog.c b/drivers/media/usb/dvb-usb/cxusb-analog.c
index 8c7d0888c721..648f947e8cce 100644
--- a/drivers/media/usb/dvb-usb/cxusb-analog.c
+++ b/drivers/media/usb/dvb-usb/cxusb-analog.c
@@ -822,7 +822,7 @@ static int cxusb_medion_v_start_streaming(struct vb2_queue *q,
 		if (!streambuf) {
 			if (i < 2) {
 				ret = -ENOMEM;
-				goto ret_freeab;
+				goto ret_freeu;
 			}
 			break;
 		}
@@ -879,8 +879,6 @@ static int cxusb_medion_v_start_streaming(struct vb2_queue *q,
 
 ret_freeu:
 	cxusb_medion_urbs_free(cxdev);
-
-ret_freeab:
 	vfree(cxdev->auxbuf.buf);
 
 ret_unstream_md:
-- 
2.34.1