[PATCH 2/2] media: mc: fix race in media_device_unregister_entity()

[Deepanshu Kartikey]

media_device_unregister_entity() checks entity->graph_obj.mdev for NULL
before taking mdev->graph_mutex, but does not check again afterwards.
If media_device_unregister() runs concurrently (for example on USB
disconnect), it unregisters every entity and clears graph_obj.mdev while
this function waits for the mutex. The waiter then calls
__media_device_unregister_entity() with a NULL mdev and faults in
ida_free(&mdev->entity_internal_idx, ...):

  Oops: general protection fault, KASAN: null-ptr-deref in range
  [0x00000000000000c8-0x00000000000000cf]
   ida_free
   __media_device_unregister_entity
   media_device_unregister_entity
   v4l2_device_release
   v4l2_open

Re-check graph_obj.mdev under the lock and skip the unregister if the
entity is already gone.

Found while testing the fix for the syzbot report at
https://syzkaller.appspot.com/bug?extid=54648a6c1187a7ef46a6

Fixes: e2c91d4d78ee ("[media] media-device: get rid of the spinlock")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Deepanshu Kartikey <kartikey406@xxxxxxxxx>
---
 drivers/media/mc/mc-device.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/mc/mc-device.c b/drivers/media/mc/mc-device.c
index f8ea7cfe10b2..039ef7d04ac7 100644
--- a/drivers/media/mc/mc-device.c
+++ b/drivers/media/mc/mc-device.c
@@ -674,7 +674,8 @@ void media_device_unregister_entity(struct media_entity *entity)
 		return;
 
 	mutex_lock(&mdev->graph_mutex);
-	__media_device_unregister_entity(entity);
+	if (entity->graph_obj.mdev)
+		__media_device_unregister_entity(entity);
 	mutex_unlock(&mdev->graph_mutex);
 }
 EXPORT_SYMBOL_GPL(media_device_unregister_entity);
-- 
2.43.0