Forwarded: [PATCH] media: em28xx: clear dev->v4l2 on v4l2 init failure

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx, syzkaller-bugs@xxxxxxxxxxxxxxxx.

***

Subject: [PATCH] media: em28xx: clear dev->v4l2 on v4l2 init failure
Author: kartikey406@xxxxxxxxx

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master



If em28xx_v4l2_init() fails after registering the video devices (for
example in v4l2_mc_create_media_graph()), the unregister_dev error path
unregisters the devices and drops the initial v4l2_device reference
with v4l2_device_put(). However, it leaves dev->v4l2 pointing at the
em28xx_v4l2 structure.

If userspace still holds an open file handle to one of the video device
nodes, the structure stays alive through that reference. When the USB
device is later disconnected, em28xx_v4l2_fini() sees the non-NULL
dev->v4l2, treats the extension as fully initialized and drops the
initial reference a second time. This underflows the refcount and
em28xx_free_v4l2() frees struct em28xx_v4l2 while the file handle is
still open. When userspace closes it, v4l2_device_release() calls
media_device_unregister_entity() on a media entity embedded in the
freed structure, resulting in a slab use-after-free:

  BUG: KASAN: slab-use-after-free in dev_dbg_obj+0x630/0x830
  Read of size 4 at addr ffff888023601bd0 by task v4l_id/6384

Fix this by clearing dev->v4l2 in the error path after dropping the
initial reference, so that em28xx_v4l2_fini() returns early and does
not put the reference again.

Reported-by: syzbot+54648a6c1187a7ef46a6@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=54648a6c1187a7ef46a6
Signed-off-by: Deepanshu Kartikey <kartikey406@xxxxxxxxx>
---
 drivers/media/usb/em28xx/em28xx-video.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
index 84424284d486..ec4ed2b0e5fd 100644
--- a/drivers/media/usb/em28xx/em28xx-video.c
+++ b/drivers/media/usb/em28xx/em28xx-video.c
@@ -3137,6 +3137,7 @@ static int em28xx_v4l2_init(struct em28xx *dev)
 	 * v4l2_device refcount to zero.
 	 */
 	v4l2_device_put(&v4l2->v4l2_dev);
+	dev->v4l2 = NULL;
 	return ret;
 }
 
-- 
2.43.0