[PATCH] media: as102: init mutexes before registering the dvb adapter

[PATCH] media: as102: init mutexes before registering the dvb adapter

[ThangNN99]

as102_dvb_register() calls dvb_register_adapter() and
dvb_register_frontend() before mutex_init()'ing bus_adap.lock and
sem. Both mutexes live inside the kzalloc'd as102_dev, so until
mutex_init() runs they are all-zero, uninitialized memory.

dvb_register_frontend() makes /dev/dvb/adapterX/frontendY openable
right away, and open() reaches as102_stream_ctrl(), which locks
bus_adap.lock. Likewise, dvb_dmxdev_init() exposes as102_dev->sem to
the demux start/stop_feed callbacks well before the two
mutex_init() calls near the end of the function run. A concurrent
open() racing the tail of as102_dvb_register() can thus lock a
mutex that was never initialized: lockdep reports this as "trying
to register non-static key", and on a real contended lock it is
worse than a missing annotation, since an uninitialized mutex has
no valid wait list.

Move both mutex_init() calls to the top of the function, before the
adapter is registered, so the locks are always ready before the
device is reachable from userspace.

Reported-by: syzbot+2a3de29133b40e8f69f3@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2a3de29133b40e8f69f3
Signed-off-by: ThangNN99 <ngocthang2710.1999@gmail.com>
---
 drivers/media/usb/as102/as102_drv.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/media/usb/as102/as102_drv.c b/drivers/media/usb/as102/as102_drv.c
index 6b1d3528a0a7..5495672c0646 100644
--- a/drivers/media/usb/as102/as102_drv.c
+++ b/drivers/media/usb/as102/as102_drv.c
@@ -287,6 +287,10 @@ int as102_dvb_register(struct as102_dev_t *as102_dev)
 	struct device *dev = &as102_dev->bus_adap.usb_dev->dev;
 	int ret;
 
+	/* locks must be ready before the device nodes become openable */
+	mutex_init(&as102_dev->bus_adap.lock);
+	mutex_init(&as102_dev->sem);
+
 	ret = dvb_register_adapter(&as102_dev->dvb_adap,
 			   as102_dev->name, THIS_MODULE,
 			   dev, adapter_nr);
@@ -341,12 +345,6 @@ int as102_dvb_register(struct as102_dev_t *as102_dev)
 		goto efereg;
 	}
 
-	/* init bus mutex for token locking */
-	mutex_init(&as102_dev->bus_adap.lock);
-
-	/* init start / stop stream mutex */
-	mutex_init(&as102_dev->sem);
-
 	/*
 	 * try to load as102 firmware. If firmware upload failed, we'll be
 	 * able to upload it later.
-- 
2.43.0