Re: [PATCH] media: rtl28xxu: fix SDR platform device leak

[Hans Verkuil]

On 21/09/2026 10:15, Guangshuo Li wrote:
> rtl2832u_tuner_attach() registers an rtl2832_sdr platform device, but
> if registration succeeds without a bound driver, it breaks out without
> unregistering the device.
> 
> dev->platform_device_sdr is assigned only after a driver is bound, so
> rtl28xxu_tuner_detach() cannot unregister the unbound device later.
> This leaves the registered platform device and its associated resources
> allocated.
> 
> Split the registration failure and driver binding checks. Unregister
> the successfully registered platform device when no driver is bound
> before leaving the switch.
> 
> The issue was identified by a static analysis tool I developed and
> confirmed by manual review.
> 
> Fixes: a2f7f220df5e ("[media] rtl28xxu: switch SDR module to platform driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
> ---
>  drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
> index 487c6ab784ab..3603d0cf638b 100644
> --- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
> +++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
> @@ -1391,8 +1391,12 @@ static int rtl2832u_tuner_attach(struct dvb_usb_adapter *adap)
>  						     "rtl2832_sdr",
>  						     PLATFORM_DEVID_AUTO,
>  						     &pdata, sizeof(pdata));
> -		if (IS_ERR(pdev) || pdev->dev.driver == NULL)
> +		if (IS_ERR(pdev))
>  			break;
> +		if (!pdev->dev.driver) {
> +			platform_device_unregister(pdev);
> +			break;
> +		}

Looking at other drivers, I think this is incomplete.

drivers/media/usb/dvb-usb-v2/zd1301.c, line 142, does it correct. Note the
try_module_get() call that is missing in rtl28xxu.c.

Regards,

	Hans

>  		dev->platform_device_sdr = pdev;
>  		break;
>  	default: