[PATCH] media: au0828: hold the vb2 queue lock when releasing the queue on close

[YuanZhe Liu]

au0828_v4l2_close() releases the vb2 queue with _vb2_fop_release(filp,
NULL) while holding dev->lock. The video and VBI queues have their own
locks (vb_queue_lock and vb_vbi_queue_lock), and v4l2_ioctl_get_lock()
serializes the queue ioctls with those instead of dev->lock. The queue
can therefore be released on close while another file handle is in the
middle of VIDIOC_REQBUFS or read().

__vb2_queue_alloc() adds each buffer to the queue before allocating its
planes, so the release can find an MMAP buffer whose mem_priv is still
NULL and hand it to vb2_vmalloc_put():

  BUG: KASAN: null-ptr-deref in vb2_vmalloc_put
  Write of size 4 at addr 0000000000000020
  Call Trace:
   vb2_vmalloc_put
   __vb2_buf_mem_free
   __vb2_queue_free
   vb2_core_queue_release
   _vb2_fop_release
   au0828_v4l2_close

Pass the queue lock to _vb2_fop_release(). Taking it while holding
dev->lock matches the lock order the driver already uses in its
unregister path, where vb2_video_unregister_device() takes the same
queue lock.

Fixes: 05439b1a3693 ("[media] media: au0828 - convert to use videobuf2")
Cc: stable@xxxxxxxxxxxxxxx
Co-developed-by: Bin Yu <byu@xxxxxxxxxxxxx>
Signed-off-by: Bin Yu <byu@xxxxxxxxxxxxx>
Co-developed-by: Cheng Wen <wencheng@xxxxxxxxxxxxx>
Signed-off-by: Cheng Wen <wencheng@xxxxxxxxxxxxx>
Signed-off-by: YuanZhe Liu <25031212351@xxxxxxxxxxxxxxxxx>
---
 drivers/media/usb/au0828/au0828-video.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/au0828/au0828-video.c b/drivers/media/usb/au0828/au0828-video.c
index 3c53105f3d2b..e3f894d67d7c 100644
--- a/drivers/media/usb/au0828/au0828-video.c
+++ b/drivers/media/usb/au0828/au0828-video.c
@@ -1094,7 +1094,7 @@ static int au0828_v4l2_close(struct file *filp)
 			pr_info("Au0828 can't set alternate to 0!\n");
 	}
 end:
-	_vb2_fop_release(filp, NULL);
+	_vb2_fop_release(filp, vdev->queue->lock);
 	dev->users--;
 	mutex_unlock(&dev->lock);
 	return 0;
-- 
2.34.1