[PATCH 1/3] media: em28xx: check dev->disconnected in em28xx_v4l2_open()

[Nguyen Duy Nhat Anh]

em28xx_v4l2_open() attempts hardware register initialization via dev->intf.
If a USB disconnect occurs concurrently, dev->intf is freed while open() is
executing, causing a KASAN slab-use-after-free read in em28xx_write_regs_req().

Fix this by checking dev->disconnected under dev->lock in em28xx_v4l2_open()
and returning -ENODEV before attempting hardware I/O.

Reported-by: syzbot+809dfc586f33fc44b6ac@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=809dfc586f33fc44b6ac
Signed-off-by: Nguyen Duy Nhat Anh <neganhat@xxxxxxxxx>
---
 drivers/media/usb/em28xx/em28xx-video.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
index 84424284d486..d653341ffd16 100644
--- a/drivers/media/usb/em28xx/em28xx-video.c
+++ b/drivers/media/usb/em28xx/em28xx-video.c
@@ -2367,7 +2367,7 @@ static int em28xx_v4l2_open(struct file *filp)
 		return -ERESTARTSYS;
 
 	v4l2 = dev->v4l2;
-	if (!v4l2) {
+	if (!v4l2 || dev->disconnected) {
 		mutex_unlock(&dev->lock);
 		return -ENODEV;
 	}
-- 
2.55.0