[PATCH] media: dvb-usb-v2: abort probe on power-on failure

[Xu Rao]

dvb_usbv2_init() powers the device on before registering the I2C adapter
and DVB resources, but it ignores failures from the power control
callback.

For CE6230, the power control callback selects interface 1 alternate
setting 1 with usb_set_interface(). A malformed device may not provide
that alternate setting, causing the initial power-on request to fail.
Probe nevertheless continues and may publish the I2C adapter before
failing later during adapter/frontend initialization.

The later failure path then synchronously unregisters the I2C adapter
while USB probe locks are still held. Userspace may already have opened
the newly published i2c-dev node, holding an adapter reference and making
i2c_del_adapter() wait indefinitely in the probe path.

Abort initialization as soon as the initial power-on step fails. This
keeps malformed devices from exposing partially initialized I2C/DVB
resources.

Fixes: c79b339f9292 ("[media] dvb_usb_v2: copy current dvb_usb as a starting point")
Cc: stable@xxxxxxxxxxxxxxx
Reported-by: syzbot+f3f24bbe63f3f6db9f44@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://lore.kernel.org/all/683a9833.a70a0220.1a6ae.000a.GAE@xxxxxxxxxx/
Tested-by: syzbot+f3f24bbe63f3f6db9f44@xxxxxxxxxxxxxxxxxxxxxxxxx
Link: https://syzkaller.appspot.com/bug?extid=f3f24bbe63f3f6db9f44
Signed-off-by: Xu Rao <raoxu@xxxxxxxxxxxxx>
---
 drivers/media/usb/dvb-usb-v2/dvb_usb_core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c b/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
index bd86d250433d..5635394e5b7d 100644
--- a/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
+++ b/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
@@ -852,7 +852,9 @@ static int dvb_usbv2_init(struct dvb_usb_device *d)
 	int ret;
 	dev_dbg(&d->udev->dev, "%s:\n", __func__);

-	dvb_usbv2_device_power_ctrl(d, 1);
+	ret = dvb_usbv2_device_power_ctrl(d, 1);
+	if (ret < 0)
+		goto err;

 	if (d->props->read_config) {
 		ret = d->props->read_config(d);
--
2.43.0