[BUG] v4l2_ctrl_request_unbind -- KASAN slab-use-after-free

[Farhad Alemi]

Hello Mauro Carvalho Chehab,

While fuzzing Linux 7.1-rc5 with syzkaller, as part of research at ASU's
SEFCOM lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/119-media-vim2m-uaf-v4l2_ctrl_request_unbind/

  ==================================================================
  BUG: KASAN: slab-use-after-free in
v4l2_ctrl_request_unbind+0x5b/0x2d0
drivers/media/v4l2-core/v4l2-ctrls-request.c:101
  Read of size 8 at addr ffff88803e2ae8a8 by task syz.4.148/13541

  CPU: 0 UID: 0 PID: 13541 Comm: syz.4.148 Not tainted 7.1.0-rc5 #1
PREEMPT(full)
  Call Trace:
   <TASK>
   dump_stack_lvl+0x94/0xd0 lib/dump_stack.c:120
   print_address_description+0x55/0x1e0 mm/kasan/report.c:378
   print_report+0x58/0x70 mm/kasan/report.c:482
   kasan_report+0x130/0x170 mm/kasan/report.c:595
   v4l2_ctrl_request_unbind+0x5b/0x2d0
drivers/media/v4l2-core/v4l2-ctrls-request.c:101
   media_request_object_unbind+0x25a/0x530 drivers/media/mc/mc-request.c:474
   media_request_clean+0x11b/0x480 drivers/media/mc/mc-request.c:49
   media_request_release drivers/media/mc/mc-request.c:72 [inline]
   kref_put include/linux/kref.h:65 [inline]
   media_request_put+0x98/0x1e0 drivers/media/mc/mc-request.c:83
   media_request_close+0x38/0x50 drivers/media/mc/mc-request.c:91
   __fput+0x435/0xa40 fs/file_table.c:510

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,