CVE-2026-68217: media: pwc: Drain fill_buf on start_streaming() failure

In the Linux kernel, the following vulnerability has been resolved:

media: pwc: Drain fillbuf on startstreaming() failure

pwcisocinit() submits its isochronous URBs with usbsubmiturb(.., GFPKERNEL) in a loop. After the first URB is submitted, its completion handler pwcisochandler() can run on another CPU before the loop finishes:

startstreaming() pwcisocinit() usbsubmiturb(urbs[0], GFPKERNEL) pwcisochandler(urbs[0]) pdev->fillbuf = pwcgetnextfillbuf(pdev) usbsubmiturb(urbs[i>0], ..) -> fails pwcisoccleanup(pdev) / kills URBs / return ret; pwccleanupqueuedbufs(pdev, VB2BUFSTATEQUEUED)

pwcgetnextfillbuf() detaches a buffer from pdev->queuedbufs and stores it in pdev->fillbuf. The error path in startstreaming() only drains pdev->queuedbufs, so the buffer parked in pdev->fillbuf is leaked. vb2startstreaming() then triggers WARNON(ownedbydrvcount).

stopstreaming() already handles this since commit 80b0963e1698 ("[media] pwc: fix WARNON"), which added the fillbuf drain in the teardown path but not in the startstreaming() error path. Mirror that handling on failure so startstreaming() returns with no buffer owned by the driver.

Issue identified by automated review of the INV-003 series at https://sashiko.dev/