[PATCH] media: siano: fix oops in smsdvb_hotplug() due to race condition

[Ryotaro Banno]

When two or more Siano tuners are connected in parallel (as in the PLEX
PX-Q1UD, which is a 4-tuner enclosure with one USB plug), a kernel oops
occurs in smsdvb_hotplug().

smsmdtv:smscore_register_client: Client already exist.
smsdvb:smsdvb_hotplug: smscore_register_client() failed -17
BUG: kernel NULL pointer dereference, address: 00000000000002f8
RIP: 0010:smsdvb_hotplug.cold+0x30/0x1a3 [smsdvb]

This happens because smsdvb_hotplug() is called twice for the same tuner
device due to a race condition. Suppose two tuners, dev_A and dev_B, are
connected in parallel:

CPU0                                   CPU1
smsusb_probe(dev_A)                   |
smscore_register_device(dev_A)        |
// add dev_A to g_smscore_devices     |
                                      |smsusb_probe(dev_B)
                                      |smscore_register_device(dev_B)
                                      |// add dev_B to g_smscore_devices
smscore_notify_callbacks(dev_A)       |
// nobody registered yet              |
sms_board_load_modules()              |
smscore_register_hotplug()            |
smsdvb_hotplug(dev_B)                 |
// first call                         |
smsdvb_hotplug(dev_A)                 |
                                      |smscore_notify_callbacks(dev_B)
                                      |smsdvb_hotplug(dev_B)
                                      |// second call and crash

The second smsdvb_hotplug() always crashes; smscore_register_client()
returns -EEXIST with the error message "Client already exist.", and the
error unwinding path calls smsdvb_media_device_unregister() while
client->coredev is NULL.

To fix the race, add the device to g_smscore_devices within the same
critical section that calls smscore_notify_callbacks().
smscore_register_hotplug() calls smsdvb_hotplug() under the same mutex,
so smsdvb_hotplug() is invoked exactly once per device.

Fixes: 2e5c1ec8865a ("V4L/DVB (8258): add support for SMS1010 and SMS1150 based digital television devices")
Assisted-by: LLM
Signed-off-by: Ryotaro Banno <ryotaro.banno@xxxxxxxxx>
---
 drivers/media/common/siano/smscoreapi.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/media/common/siano/smscoreapi.c b/drivers/media/common/siano/smscoreapi.c
index 017629e3cf84..c413f9696cb7 100644
--- a/drivers/media/common/siano/smscoreapi.c
+++ b/drivers/media/common/siano/smscoreapi.c
@@ -731,11 +731,6 @@ int smscore_register_device(struct smsdevice_params_t *params,
 
 	smscore_registry_settype(dev->devpath, params->device_type);
 
-	/* add device to devices list */
-	mutex_lock(&g_smscore_deviceslock);
-	list_add(&dev->entry, &g_smscore_devices);
-	mutex_unlock(&g_smscore_deviceslock);
-
 	*coredev = dev;
 
 	pr_debug("device %p created\n", dev);
@@ -892,6 +887,9 @@ int smscore_start_device(struct smscore_device_t *coredev)
 
 	mutex_lock(&g_smscore_deviceslock);
 
+	/* add device to devices list */
+	list_add(&coredev->entry, &g_smscore_devices);
+
 	rc = smscore_notify_callbacks(coredev, coredev->device, 1);
 	smscore_init_ir(coredev);
 

base-commit: d7e7bca7169873b46e857c025c10f3336c1258d8
-- 
2.54.0