[lvc-project] [PATCH] media: dvb-usb-v2: fix race between device probe and demux filter setup

[Dmitry Antipov]

Syzbot has reported crash caused by the following userspace program:

Thread 1                               Thread 2

fd = open("/dev/raw_gadget", ...);     fd = open("/dev/dvb/adapterX/demuxY");
ioctl(fd, USB_RAW_IOCTL_EP0_WRITE,     ioctl(fd, DMX_SET_RES_FILTER, ...);
      [fake descriptor of Hauppauge
       126xxx ATSC+ device]);

That is, dvb_usb_start_feed() may be called before dvb_usbv2_adapter_init()
has completed frontend initialization with dvb_usbv2_adapter_frontend_init().
Fix this by setting active frontend index to -1 early, this making sure
that such a preliminary attempt to start the feed just returns -EINVAL.

Reported-by: syzbot+ffac2da5e6f8ad2671b2 at syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ffac2da5e6f8ad2671b2
Signed-off-by: Dmitry Antipov <dmantipov at yandex.ru>
---
 drivers/media/usb/dvb-usb-v2/dvb_usb_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c b/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
index bd86d250433d..37353bd40a10 100644
--- a/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
+++ b/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
@@ -637,7 +637,6 @@ static int dvb_usbv2_adapter_frontend_init(struct dvb_usb_adapter *adap)
 	dev_dbg(&d->udev->dev, "%s: adap=%d\n", __func__, adap->id);
 
 	memset(adap->fe, 0, sizeof(adap->fe));
-	adap->active_fe = -1;
 
 	if (d->props->frontend_attach) {
 		ret = d->props->frontend_attach(adap);
@@ -759,6 +758,7 @@ static int dvb_usbv2_adapter_init(struct dvb_usb_device *d)
 	for (i = 0; i < adapter_count; i++) {
 		adap = &d->adapter[i];
 		adap->id = i;
+		adap->active_fe = -1;
 		adap->props = &d->props->adapter[i];
 
 		/* speed - when running at FULL speed we need a HW PID filter */
-- 
2.56.0