Forwarded: [PATCH] media: dvb-usb-v2: abort probe on power-on failure

Forwarded: [PATCH] media: dvb-usb-v2: abort probe on power-on failure

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] media: dvb-usb-v2: abort probe on power-on failure
Author: raoxu@uniontech.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

dvb_usbv2_init() powers the device on before registering the I2C adapter
and DVB resources, but it ignores errors from the power control callback.

For CE6230, the power control callback selects interface 1 alternate
setting 1 with usb_set_interface(). A malformed device may not provide
that alternate setting, causing the initial power-on request to fail.
Probe nevertheless continues and may publish the I2C adapter before
failing later during adapter/frontend initialization.

That leaves the probe error path to synchronously unregister the I2C
adapter while USB probe locks are still held. Userspace may already have
opened the newly published i2c-dev node, holding an adapter reference and
making i2c_del_adapter() wait indefinitely in the probe path.

Abort initialization as soon as the initial power-on step fails. This
keeps malformed devices from exposing partially initialized I2C/DVB
resources.

Fixes: c79b339f9292 ("[media] dvb_usb_v2: copy current dvb_usb as a starting point")
Reported-by: syzbot+f3f24bbe63f3f6db9f44@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/683a9833.a70a0220.1a6ae.000a.GAE@google.com/
Signed-off-by: Xu Rao <raoxu@uniontech.com>
---
 drivers/media/usb/dvb-usb-v2/dvb_usb_core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c b/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
index bd86d250433d..5635394e5b7d 100644
--- a/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
+++ b/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
@@ -852,7 +852,9 @@ static int dvb_usbv2_init(struct dvb_usb_device *d)
 	int ret;
 	dev_dbg(&d->udev->dev, "%s:\n", __func__);

-	dvb_usbv2_device_power_ctrl(d, 1);
+	ret = dvb_usbv2_device_power_ctrl(d, 1);
+	if (ret < 0)
+		goto err;

 	if (d->props->read_config) {
 		ret = d->props->read_config(d);
--
2.43.0