[PATCH] media: cxusb: Fix URB leak on start_streaming failure

[Guangshuo Li]

When the streaming buffer allocation fails during one of the first two
URB iterations, cxusb_medion_v_start_streaming() jumps to ret_freeab,
which only frees the auxiliary buffer.  The URBs already allocated and
stored in cxdev->streamurbs[] are leaked: the error label that calls
cxusb_medion_urbs_free() is skipped, and videobuf2 does not call
stop_streaming() after a failed start_streaming().

Jump to ret_freeu instead so the already allocated URBs are freed too
before the auxiliary buffer.

This issue was found by our static analysis tool under development.

Fixes: e478d40540544 ("media: cxusb: add analog mode support for Medion MD95700")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: OpenAI:gpt-6-astra
Signed-off-by: Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx>
---
Build-tested the changed objects with x86_64 allmodconfig.
No runtime or fault-injection testing was performed.

 drivers/media/usb/dvb-usb/cxusb-analog.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/media/usb/dvb-usb/cxusb-analog.c b/drivers/media/usb/dvb-usb/cxusb-analog.c
index 8c7d0888c721..648f947e8cce 100644
--- a/drivers/media/usb/dvb-usb/cxusb-analog.c
+++ b/drivers/media/usb/dvb-usb/cxusb-analog.c
@@ -822,7 +822,7 @@ static int cxusb_medion_v_start_streaming(struct vb2_queue *q,
 		if (!streambuf) {
 			if (i < 2) {
 				ret = -ENOMEM;
-				goto ret_freeab;
+				goto ret_freeu;
 			}
 			break;
 		}
@@ -879,8 +879,6 @@ static int cxusb_medion_v_start_streaming(struct vb2_queue *q,
 
 ret_freeu:
 	cxusb_medion_urbs_free(cxdev);
-
-ret_freeab:
 	vfree(cxdev->auxbuf.buf);
 
 ret_unstream_md:
base-commit: d89e1d186ec9271bf78e62771779e9fc03bf0fc3
-- 
2.43.0