On Tue, Jul 27, 2021 at 11:13:13PM +0800, Dongliang Mu wrote: > On Tue, Jul 27, 2021 at 10:15 PM Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote: > > > > On Tue, Jul 27, 2021 at 06:01:51PM +0800, Hillf Danton wrote: > > > Along the probe path, > > > > > > em28xx_usb_probe > > > dev = kzalloc(sizeof(*dev), GFP_KERNEL); > > > retval = em28xx_init_dev(dev, udev, intf, nr); > > > em28xx_init_extension(dev); > > > em28xx_ir_init(struct em28xx *dev) > > > kref_get(&dev->ref); > > > > > > kref_init(&dev->ref); > > > > Hi Dan, > > I have developed a patch [1] to fix this crash. Would you like to help > me double-check if it correctly fixes the underlying bug? > > [1] [PATCH v2] [media] em28xx-input: fix refcount bug in > em28xx_usb_disconnect https://lkml.org/lkml/2021/7/19/263 No one likes to review patches which aren't sent over email... :/ LKML.org doesn't give the message-id so I can't use b4 to download the email. That patch doesn't make any sense. We call kref_get() at the start of the function so we need to call kref_put() at the end. The fact that em28xx_ir_fini() calls kref_put() doesn't matter. We will only call fini if the init() succeeds (hopefully). The em28xx_ir_init() error handling is Ad Hoc Style but I don't see anything outright buggy. I think Hillf's approach is correct. regards, dan carpenter
