media: dvb-bt8xx: Fix double-free in dst_attach()

The caller in dvb-bt8xx.c (frontend_init) already frees the allocated dst_state when dvb_attach(dst_attach, ...) returns NULL:

  if (dvb_attach(dst_attach, state, &card->dvb_adapter) == NULL) {
    pr_err("%s: Could not find a Twinhan DST\n", __func__);
    kfree(state);
    break;
  }

Remove the redundant kfree() calls from dst_attach() to avoid double-freeing the state on failure paths. This keeps ownership with the caller until a successful attachment transfers it to the frontend.

---
v2:
* Update the subject to refer to dst_attach() instead of frontend_init().
* Add Fixes and Cc tags.
* Thanks to Markus Elfring for the helpful suggestions.

---
 drivers/media/pci/bt8xx/dst.c | 2 --
 1 file changed, 2 deletions(-)

index 110651e47831..5cdf8a77260c 100644
@@ -1694,7 +1694,6 @@ struct dst_state *dst_attach(struct dst_state *state, struct dvb_adapter *dvb_ad
 {
 	/* check if the ASIC is there */
 	if (dst_probe(state) < 0) {
-		kfree(state);
 		return NULL;
 	}
 	/* determine settings based on type */

@@ -1714,7 +1713,6 @@ struct dst_state *dst_attach(struct dst_state *state, struct dvb_adapter *dvb_ad
 		break;
 	default:
 		pr_err("unknown DST type. please report to the LinuxTV.org DVB mailinglist.\n");
-		kfree(state);
 		return NULL;
 	}
 	state->frontend.demodulator_priv = state;

2.43.0