[BUG] pvrusb2: GPF and use-after-free tearing down a partially-built v4l2 device

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/143-media-pvrusb2-gpf-partial-v4l2-teardown/

  pvrusb2: Destroying pvr_v4l2_fh id=ffff88812f7f5000
  Oops: general protection fault, probably for non-canonical address
0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
  Call Trace:
   pvr2_v4l2_destroy_no_lock
drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:846 [inline]
   pvr2_v4l2_release+0x3c3/0x550 drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:918
   v4l2_release+0x24e/0x370 drivers/media/v4l2-core/v4l2-dev.c:471
   __fput+0x435/0xa40 fs/file_table.c:510
   task_work_run+0x1d5/0x250 kernel/task_work.c:233
   do_exit+0x6ee/0x2360 kernel/exit.c:976
   do_group_exit+0x20c/0x2c0 kernel/exit.c:1119
   get_signal+0x12b2/0x1410 kernel/signal.c:3037

  RIP: 0010:pvr2_v4l2_dev_destroy+0xb5/0x320
drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:805
  BUG: KASAN: slab-use-after-free in pvr2_v4l2_open+0x1b8/0x720
  BUG: KASAN: slab-use-after-free in pvr2_v4l2_release+0x289/0x550

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,