Forwarded: [PATCH] media: em28xx: clear dev->v4l2 on v4l2 init failure

[syzbot <syzbot+54648a6c1187a7ef46a6@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] media: em28xx: clear dev->v4l2 on v4l2 init failure
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master



If em28xx_v4l2_init() fails after registering the video devices (for
example in v4l2_mc_create_media_graph()), the unregister_dev error path
drops the initial v4l2_device reference but leaves dev->v4l2 set.

If userspace still holds an open file handle to a video node, the
structure stays alive. On USB disconnect, em28xx_v4l2_fini() sees the
non-NULL dev->v4l2 and drops the initial reference a second time. The
refcount underflows, em28xx_free_v4l2() frees struct em28xx_v4l2, and
the later close() makes v4l2_device_release() touch a media entity in
freed memory (slab-use-after-free in dev_dbg_obj()).

Clear dev->v4l2 in the error path so em28xx_v4l2_fini() returns early.

Reported-by: syzbot+54648a6c1187a7ef46a6@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=54648a6c1187a7ef46a6
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/media/mc/mc-device.c            | 3 ++-
 drivers/media/usb/em28xx/em28xx-video.c | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/mc/mc-device.c b/drivers/media/mc/mc-device.c
index f8ea7cfe10b2..039ef7d04ac7 100644
--- a/drivers/media/mc/mc-device.c
+++ b/drivers/media/mc/mc-device.c
@@ -674,7 +674,8 @@ void media_device_unregister_entity(struct media_entity *entity)
 		return;
 
 	mutex_lock(&mdev->graph_mutex);
-	__media_device_unregister_entity(entity);
+	if (entity->graph_obj.mdev)
+		__media_device_unregister_entity(entity);
 	mutex_unlock(&mdev->graph_mutex);
 }
 EXPORT_SYMBOL_GPL(media_device_unregister_entity);
diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
index 84424284d486..ec4ed2b0e5fd 100644
--- a/drivers/media/usb/em28xx/em28xx-video.c
+++ b/drivers/media/usb/em28xx/em28xx-video.c
@@ -3137,6 +3137,7 @@ static int em28xx_v4l2_init(struct em28xx *dev)
 	 * v4l2_device refcount to zero.
 	 */
 	v4l2_device_put(&v4l2->v4l2_dev);
+	dev->v4l2 = NULL;
 	return ret;
 }
 
-- 
2.43.0