[BUG] media: mxl111sf: general protection fault in dvb_usbv2_generic_write via I2C_RDWR

[ZW Tang]

Hi,

I am reporting a general protection fault triggered by a syzkaller
reproducer on Linux 7.2-rc3.

The crash happens in the DVB-USB-V2 MXL111SF driver path. The reproducer
creates a dummy USB device that is recognized as a Hauppauge 126xxx ATSC+
device, opens the corresponding I2C device, and issues an I2C_RDWR ioctl.
The ioctl reaches mxl111sf_i2c_xfer(), then mxl111sf_ctrl_msg(), and finally
dvb_usbv2_generic_write(), where the kernel crashes while trying to lock a
mutex.

This looks like a race / lifetime issue during DVB-USB-V2 device
initialization or failed probe handling. The I2C adapter appears to be usable
from userspace while the MXL111SF device state is not fully initialized or is
already in an error path. As a result, the I2C transfer path can dereference
invalid DVB-USB-V2 state and crash in mutex_lock().

Reproducer:
syz reproducer:
#{"repeat":true,"procs":5,"slowdown":1,"sandbox":"","sandbox_arg":0,"close_fds":false,"callcomments":true}
syz_usb_connect(0x0, 0x24,
&(0x7f0000000000)=ANY=[@ANYBLOB="1201000034276d20402003c68e0100000001090212000100000000090400"],
0x0)
r0 = syz_open_dev$I2C(&(0x7f00000001c0), 0x78b5, 0x80)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000080)={&(0x7f0000002480)=[{0x5,
0x0, 0x0, 0x0}, {0xf, 0x200, 0x0, 0x0}], 0x2})

console output: https://pastebin.com/raw/egyGjxyf
kernel config: https://pastebin.com/SGRihsun

Kernel:
HEAD commit: 1137d8b5df06137fb49513cc923b3b24d94cb809
git tree: torvalds/linux
kernel version: 7.2.0-rc3 #1 PREEMPT(full) (QEMU Ubuntu 24.10)

Crash log:

[ 83.536552][ T30] usb 5-1: dvb_usb_v2: found a 'Hauppauge 126xxx
ATSC+' in warm state
[ 83.596815][ T30] usb 5-1: selecting invalid altsetting 1
[ 83.597825][ T30] set interface failed
[ 83.597840][ T30] usb 5-1: dvb_usb_v2: usb_bulk_msg() failed=-22
[ 83.599709][ T30] error writing reg: 0xff, val: 0x00
[ 83.730873][T12337] Oops: general protection fault, probably for
non-canonical address 0xdffffc0000000018: 0000 [#1] SMP KASAN NOPTI
[ 83.732890][T12337] KASAN: null-ptr-deref in range
[0x00000000000000c0-0x00000000000000c7]
[ 83.734294][T12337] CPU: 1 UID: 0 PID: 12337 Comm: syz.4.21 Not
tainted 7.2.0-rc3 #1 PREEMPT(full)
[ 83.737644][T12337] RIP: 0010:__mutex_lock+0x127/0x2760

Call Trace:
<TASK>
? dvb_usbv2_generic_write+0x25/0x60
? mxl111sf_ctrl_msg+0xc5/0x300
dvb_usbv2_generic_write+0x25/0x60
mxl111sf_ctrl_msg+0x26a/0x300
mxl111sf_write_reg+0x93/0x1a0
mxl111sf_i2c_start+0x72/0x290
mxl111sf_i2c_xfer+0x1e84/0x3640
__i2c_transfer+0x522/0x16b0
i2c_transfer+0x1d4/0x380
i2cdev_ioctl_rdwr.isra.0+0x37e/0x730
i2cdev_ioctl+0x2a9/0x860
__x64_sys_ioctl+0x199/0x220
do_syscall_64+0xc4/0x7a0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
</TASK>

Best Regards