[BUG] media: s2255: refcount_t addition on 0 in s2255_probe_v4l()

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/157-media-s2255-refcount-inc-on-zero/

  refcount_t: addition on 0; use-after-free.
  WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x9f/0x110,
CPU#1: kworker/1:0/24
  Workqueue: usb_hub_wq hub_event
  Call Trace:
   refcount_warn_saturate+0x9f/0x110
   s2255_probe_v4l+0x73a/0x9e0
   s2255_probe+0xbdd/0x10a0
   usb_probe_interface+0x659/0xc70
   really_probe+0x267/0xaf0
   __driver_probe_device+0x1e2/0x350
   driver_probe_device+0x4f/0x240
   __device_attach_driver+0x270/0x410
   bus_for_each_drv+0x258/0x2f0
   __device_attach+0x2c5/0x450
   device_add+0x7ec/0xb90
  Kernel panic - not syncing: kernel: panic_on_warn set ...

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,