[PATCH 0/3] media: em28xx: fix multiple disconnect races and UAFs

[Nguyen Duy Nhat Anh]

This patch series addresses three distinct lifecycle and race condition bugs in
the em28xx driver triggered during concurrent USB disconnect and userspace
file operations (open/close).

Fixing the initial refcount underflow (addressed in Patch 3/3) allowed
syzbot re-testing to progress further down the teardown pipeline, which
subsequently unveiled two deeper Use-After-Free (UAF) bugs in sequence
(Patches 1/3 and 2/3). 

Summary of changes in the patches:

1. media: em28xx: check dev->disconnected in em28xx_v4l2_open()
   Rejects open() attempts with -ENODEV when the device is disconnected,
   preventing hardware register I/O on freed dev->intf memory.

2. media: em28xx: clear v4l2_dev.mdev on media device unregister
   Zeros out v4l2_dev.mdev in em28xx_unregister_media_device() before freeing
   dev->media_dev, avoiding a dangling pointer read in v4l2_release() during
   file close.

3. media: em28xx: fix refcount underflow in em28xx_free_v4l2()
   Removes v4l2_device_unregister() from the v4l2_dev release callback
   em28xx_free_v4l2() and invokes it in em28xx_v4l2_fini() instead, eliminating
   an illegal double-decrement on a zero reference count.

Nguyen Duy Nhat Anh (3):
  media: em28xx: check dev->disconnected in em28xx_v4l2_open()
  media: em28xx: clear v4l2_dev.mdev on media device unregister
  media: em28xx: fix refcount underflow in em28xx_free_v4l2()

 drivers/media/usb/em28xx/em28xx-cards.c | 2 ++
 drivers/media/usb/em28xx/em28xx-video.c | 5 ++---
 2 files changed, 4 insertions(+), 3 deletions(-)

-- 
2.55.0