[PATCH v3 2/2] media: v4l2-subdev: Fix NULL pointer dereference in the EXT_CTRLS ioctls

[Nicola Fiorillo]

VIDIOC_G_EXT_CTRLS, VIDIOC_S_EXT_CTRLS and VIDIOC_TRY_EXT_CTRLS on a
sub-device node pass sd->v4l2_dev->mdev to the control framework.
v4l2_device_unregister_subdev() clears sd->v4l2_dev before it
unregisters the device node, and nothing serialises the
video_is_registered() checks in v4l2_ioctl() and subdev_do_ioctl_lock()
against it: sub-device nodes have no vdev->lock, and unregistration
would not take it anyway. An EXT_CTRLS ioctl on a file handle opened
before a driver is unbound can therefore dereference NULL:

  KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
  RIP: 0010:subdev_do_ioctl+0x1926/0x2550
  Call Trace:
   subdev_do_ioctl_lock+0x246/0x5c0
   video_usercopy+0x47b/0xcc0
   v4l2_ioctl+0x187/0x1f0
   __x64_sys_ioctl+0x134/0x1c0

Use vdev->v4l2_dev->mdev instead, as the previous patch does in
subdev_open(), and as the video node ioctls already do.

Found by reading the code, then reproduced in QEMU with KASAN: with the
previous patch applied, threads looping on VIDIOC_G_EXT_CTRLS on vimc's
sub-device nodes while vimc is unbound and rebound hit the oops above;
with this patch the same test shows no oops, KASAN report or warning.

Fixes: c41e9cff704a ("media: v4l2-ctrls: support g/s_ext_ctrls for requests")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: LLM
Signed-off-by: Nicola Fiorillo <nicfio@xxxxxxxxx>
---
 drivers/media/v4l2-core/v4l2-subdev.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c
index c56ca328f..1a2ae7c13 100644
--- a/drivers/media/v4l2-core/v4l2-subdev.c
+++ b/drivers/media/v4l2-core/v4l2-subdev.c
@@ -775,19 +775,19 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg,
 		if (!vfh->ctrl_handler)
 			return -ENOTTY;
 		return v4l2_g_ext_ctrls(vfh->ctrl_handler,
-					vdev, sd->v4l2_dev->mdev, arg);
+					vdev, vdev->v4l2_dev->mdev, arg);
 
 	case VIDIOC_S_EXT_CTRLS:
 		if (!vfh->ctrl_handler)
 			return -ENOTTY;
 		return v4l2_s_ext_ctrls(vfh, vfh->ctrl_handler,
-					vdev, sd->v4l2_dev->mdev, arg);
+					vdev, vdev->v4l2_dev->mdev, arg);
 
 	case VIDIOC_TRY_EXT_CTRLS:
 		if (!vfh->ctrl_handler)
 			return -ENOTTY;
 		return v4l2_try_ext_ctrls(vfh->ctrl_handler,
-					  vdev, sd->v4l2_dev->mdev, arg);
+					  vdev, vdev->v4l2_dev->mdev, arg);
 
 	case VIDIOC_DQEVENT:
 		if (!(sd->flags & V4L2_SUBDEV_FL_HAS_EVENTS))
-- 
2.47.3