[lvc-project] [PATCH 2/2] media: em28xx: fix race between em28xx_free_v4l2() and em28xx_v4l2_fini()

[Dmitry Antipov]

Take device (an instance of 'struct em28xx') lock in 'em28xx_free_v4l2()'
and do the same early in 'em28xx_v4l2_fini()' to avoid UaF-triggering
racy access to 'v4l2' member.

Reported-by: syzbot+dd0f06181ab66b93dc00 at syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=dd0f06181ab66b93dc00
Fixes: 288254383674 ("media: em28xx: use v4l2_device release callback")
Signed-off-by: Dmitry Antipov <dmantipov at yandex.ru>
---
 drivers/media/usb/em28xx/em28xx-video.c | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
index 324855ff5e86..3b8766d00897 100644
--- a/drivers/media/usb/em28xx/em28xx-video.c
+++ b/drivers/media/usb/em28xx/em28xx-video.c
@@ -2305,9 +2305,14 @@ static void em28xx_free_v4l2(struct v4l2_device *v4l2_dev)
 		container_of(v4l2_dev, struct em28xx_v4l2, v4l2_dev);
 	struct em28xx *dev = v4l2->dev;
 
+	mutex_lock(&dev->lock);
+
 	v4l2_ctrl_handler_free(&v4l2->ctrl_handler);
 	v4l2_device_unregister(v4l2_dev);
 	dev->v4l2 = NULL;
+
+	mutex_unlock(&dev->lock);
+
 	kfree(v4l2);
 	kref_put(&dev->ref, em28xx_free_device);
 }
@@ -2388,25 +2393,24 @@ static int em28xx_v4l2_open(struct file *filp)
  */
 static int em28xx_v4l2_fini(struct em28xx *dev)
 {
-	struct em28xx_v4l2 *v4l2 = dev->v4l2;
+	struct em28xx_v4l2 *v4l2;
 
-	if (dev->is_audio_only) {
-		/* Shouldn't initialize IR for this interface */
-		return 0;
-	}
+	mutex_lock(&dev->lock);
 
-	if (!dev->has_video) {
-		/* This device does not support the v4l2 extension */
+	if (dev->is_audio_only || /* Shouldn't initialize IR for this interface */
+	    !dev->has_video) {    /* This device does not support the v4l2 extension */
+		mutex_unlock(&dev->lock);
 		return 0;
 	}
 
-	if (!v4l2)
+	v4l2 = dev->v4l2;
+	if (!v4l2) {
+		mutex_unlock(&dev->lock);
 		return 0;
+	}
 
 	dev_info(&dev->intf->dev, "Closing video extension\n");
 
-	mutex_lock(&dev->lock);
-
 	v4l2_device_disconnect(&v4l2->v4l2_dev);
 
 	em28xx_uninit_usb_xfer(dev, EM28XX_ANALOG_MODE);
-- 
2.55.0