Re: [syzbot] [media?] KASAN: use-after-free Read in em28xx_close_extension (2)

[Fedor Pchelkin]

#syz test

--- a/drivers/media/usb/em28xx/em28xx-cards.c
+++ b/drivers/media/usb/em28xx/em28xx-cards.c
@@ -3445,17 +3445,16 @@ static void request_module_async(struct work_struct *work)
 
        /*
         * Devices with an audio-only intf also have a V4L/DVB/RC
-        * intf. Don't register extensions twice on those devices.
+        * intf.
         */
        if (dev->is_audio_only) {
 #if defined(CONFIG_MODULES) && defined(MODULE)
                request_module("em28xx-alsa");
 #endif
+               em28xx_init_extension(dev);
                return;
        }
 
-       em28xx_init_extension(dev);
-
 #if defined(CONFIG_MODULES) && defined(MODULE)
        if (dev->has_video)
                request_module("em28xx-v4l");
@@ -3469,6 +3468,8 @@ static void request_module_async(struct work_struct *work)
            ((dev->board.ir_codes || dev->board.has_ir_i2c) && !disable_ir))
                request_module("em28xx-rc");
 #endif /* CONFIG_MODULES */
+
+       em28xx_init_extension(dev);
 }
 
 static void request_modules(struct em28xx *dev)
@@ -3676,8 +3677,6 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,
                        retval = -ENODEV;
                        goto err_deinit_media;
                }
-               em28xx_init_extension(dev);
-
                return 0;
        }