[BUG] media: em28xx: slab-use-after-free in v4l2_open after failed device initialization

[ZW Tang]

Hi,

I am reporting a KASAN slab-use-after-free triggered by a syzkaller
reproducer on Linux 7.2-rc3.

The crash happens when userspace opens a V4L2 device node after an em28xx
USB device initialization failure. The reproducer creates a malformed USB
device that is handled by the em28xx driver. During initialization, the
driver fails to create the media graph and deregisters the V4L2 video
device. Shortly after that, the userspace v4l_id helper opens the video
device node, and v4l2_open() accesses an object that has already been freed
by em28xx_v4l2_init().

This looks like a lifetime / error-path race in the em28xx V4L2
initialization and cleanup path. A video device appears to remain openable
from userspace while the corresponding em28xx V4L2 state has already been
freed after initialization failure.

Reproducer:
syz reproducer: https://pastebin.com/raw/g5jt5J3i
console output: https://pastebin.com/raw/iHCH4sqb
kernel config: https://pastebin.com/raw/Vb7Nyby9

Kernel:
HEAD commit: 1137d8b5df06137fb49513cc923b3b24d94cb809
git tree: torvalds/linux
kernel version: 7.2.0-rc3 #1 PREEMPT(full) (QEMU Ubuntu 24.10)

Crash log:

[ 132.164220][T10253] usb 4-1: Decoder not found
[ 132.165038][T10253] em28xx 4-1:0.132: failed to create media graph
[ 132.166092][T10253] em28xx 4-1:0.132: V4L2 device video103 deregistered
[ 132.182588][ T24] em28xx 1-1:0.132: Freeing device
[ 132.257480][T10224] em28xx 2-1:0.132: Registering V4L2 extension
[ 132.332783][T10224] em28xx 2-1:0.132: failed to create media graph
[ 132.341200][T10224] em28xx 2-1:0.132: V4L2 device video103 deregistered
[ 132.351592][T15221] BUG: KASAN: slab-use-after-free in v4l2_open+0x462/0x530
[ 132.354158][T15221] Read of size 4 at addr ffff888012fd0860 by task
v4l_id/15221

Call Trace:
<TASK>
dump_stack_lvl+0x116/0x1b0
print_report+0xfb/0x5c0
kasan_report+0x96/0xd0
v4l2_open+0x462/0x530
chrdev_open+0x1f0/0x590
do_dentry_open+0x6f0/0x14e0
vfs_open+0x82/0x3f0
path_openat+0x29a2/0x3e20
do_file_open+0x216/0x310
do_sys_openat2+0x54f/0x7b0
do_sys_open+0xc6/0x150
__x64_sys_openat+0x9d/0x110
do_syscall_64+0xc4/0x7a0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
</TASK>

Allocated by task 10224:
__kasan_kmalloc+0xaa/0xb0
__kmalloc_cache_noprof+0x2dc/0x780
em28xx_v4l2_init+0x12d/0x41e0
em28xx_init_extension+0x139/0x200
request_module_async+0x61/0x70
process_scheduled_works+0x5ed/0x1c90
worker_thread+0x5be/0xd20
kthread+0x404/0x530
ret_from_fork+0x7c5/0xde0
ret_from_fork_asm+0x1a/0x30

Freed by task 10224:
__kasan_slab_free+0x61/0x80
kfree+0x2ac/0x6d0
em28xx_v4l2_init+0xd2d/0x41e0
em28xx_init_extension+0x139/0x200
request_module_async+0x61/0x70
process_scheduled_works+0x5ed/0x1c90
worker_thread+0x5be/0xd20
kthread+0x404/0x530
ret_from_fork+0x7c5/0xde0
ret_from_fork_asm+0x1a/0x30

The buggy address belongs to a freed kmalloc-8k object:
ffff888012fd0000-ffff888012fd2000


Best Regards