[PATCH 3/3] media: em28xx: fix refcount underflow in em28xx_free_v4l2()

[Nguyen Duy Nhat Anh]

em28xx_free_v4l2() is registered as the v4l2_dev release callback, invoked
when v4l2_dev's reference count drops to zero.

Calling v4l2_device_unregister() from inside this callback causes an extra
call to v4l2_device_put() on a zero reference count, triggering a refcount_t
underflow (0 -> -1) and a kernel BUG in lib/refcount.c.

Fix this by removing v4l2_device_unregister() from em28xx_free_v4l2() and
calling it in em28xx_v4l2_fini() during teardown instead.

Reported-by: syzbot+809dfc586f33fc44b6ac@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=809dfc586f33fc44b6ac
Signed-off-by: Nguyen Duy Nhat Anh <neganhat@xxxxxxxxx>
---
 drivers/media/usb/em28xx/em28xx-video.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
index d653341ffd16..45b62655ca3b 100644
--- a/drivers/media/usb/em28xx/em28xx-video.c
+++ b/drivers/media/usb/em28xx/em28xx-video.c
@@ -2332,7 +2332,6 @@ static void em28xx_free_v4l2(struct v4l2_device *v4l2_dev)
 	struct em28xx *dev = v4l2->dev;
 
 	v4l2_ctrl_handler_free(&v4l2->ctrl_handler);
-	v4l2_device_unregister(v4l2_dev);
 	dev->v4l2 = NULL;
 	kfree(v4l2);
 	kref_put(&dev->ref, em28xx_free_device);
@@ -2462,7 +2461,7 @@ static int em28xx_v4l2_fini(struct em28xx *dev)
 	 * The em28xx_free_v4l2() release callback will be invoked once all
 	 * userspace file handles to the video device nodes are closed.
 	 */
-	v4l2_device_put(&v4l2->v4l2_dev);
+	v4l2_device_unregister(&v4l2->v4l2_dev);
 
 	return 0;
 }
-- 
2.55.0