If video_register_device() fails, probe skips cleanup of the control handler and the registered SPI controller before freeing dev. This leaks control allocations and leaves the controller registered with driver data pointing to freed memory. Jump to err_free_controls to unwind both resources before unregistering the V4L2 device and freeing dev. This issue was found by our static analysis tool under development. Fixes: 2e68f841a5d1 ("[media] msi3101: use msi001 tuner driver") Cc: stable@vger.kernel.org Assisted-by: OpenAI:gpt-6-astra Signed-off-by: Guangshuo Li --- Build-tested drivers/media/usb/msi2500/msi2500.o with x86_64 allmodconfig (GCC, W=1). Rechecked the complete probe rollback. No hardware runtime or fault-injection testing was performed. drivers/media/usb/msi2500/msi2500.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/usb/msi2500/msi2500.c b/drivers/media/usb/msi2500/msi2500.c index 282256ab812a..2a2773722172 100644 --- a/drivers/media/usb/msi2500/msi2500.c +++ b/drivers/media/usb/msi2500/msi2500.c @@ -1280,7 +1280,7 @@ static int msi2500_probe(struct usb_interface *intf, if (ret) { dev_err(dev->dev, "Failed to register as video device (%d)\n", ret); - goto err_unregister_v4l2_dev; + goto err_free_controls; } dev_info(dev->dev, "Registered as %s\n", video_device_node_name(&dev->vdev)); base-commit: d89e1d186ec9271bf78e62771779e9fc03bf0fc3