[PATCH 2/3] media: em28xx: clear v4l2_dev.mdev on media device unregister

[Nguyen Duy Nhat Anh <neganhat@gmail.com>]

em28xx_unregister_media_device() frees dev->media_dev, but leaves
v4l2_dev.mdev holding a dangling pointer to the freed allocation.

When a process closes a video node after disconnect, v4l2_release() calls
v4l2_device_supports_requests(), dereferencing v4l2_dev.mdev and causing a
KASAN slab-use-after-free read.

Fix this by setting v4l2_dev.mdev to NULL in em28xx_unregister_media_device()
prior to calling kfree(dev->media_dev).

Reported-by: syzbot+809dfc586f33fc44b6ac@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=809dfc586f33fc44b6ac
Signed-off-by: Nguyen Duy Nhat Anh <neganhat@gmail.com>
---
 drivers/media/usb/em28xx/em28xx-cards.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
index 8440eafad44e..40fec8b025e8 100644
--- a/drivers/media/usb/em28xx/em28xx-cards.c
+++ b/drivers/media/usb/em28xx/em28xx-cards.c
@@ -3776,6 +3776,8 @@ static void em28xx_unregister_media_device(struct em28xx *dev)
 	if (dev->media_dev) {
 		media_device_unregister(dev->media_dev);
 		media_device_cleanup(dev->media_dev);
+		if (dev->v4l2)
+			dev->v4l2->v4l2_dev.mdev = NULL;
 		kfree(dev->media_dev);
 		dev->media_dev = NULL;
 	}
-- 
2.55.0