Syzkaller reports [1] a slab-use-after-free error identified by KASAN sanitizer and most likely caused by the wrong order of device unregister steps once a call to video_register_device() fails. Fix aforementioned flaw by first freeing control and reference handlers and only then dealing with dev->v4l2_dev() via v4l2_device_unregister(). [1] Syzkaller (partial) report: BUG: KASAN: slab-use-after-free in v4l2_release+0x3e2/0x460 drivers/media/v4l2-core/v4l2-dev.c:453 Read of size 8 at addr ffff8880502e80c8 by task v4l_id/7854 CPU: 1 UID: 0 PID: 7854 Comm: v4l_id Not tainted 6.12.0-rc7-syzkaller-00125-gcfaaa7d010d1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 v4l2_release+0x3e2/0x460 drivers/media/v4l2-core/v4l2-dev.c:453 __fput+0x3f6/0xb60 fs/file_table.c:431 __fput_sync+0x45/0x50 fs/file_table.c:516 __do_sys_close fs/open.c:1567 [inline] __se_sys_close fs/open.c:1552 [inline] __x64_sys_close+0x86/0x100 fs/open.c:1552 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... Allocated by task 6058: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kmalloc_noprof include/linux/slab.h:878 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] hackrf_probe+0xd1/0x1cf0 drivers/media/usb/hackrf/hackrf.c:1353 usb_probe_interface+0x309/0x9d0 drivers/usb/core/driver.c:399 ... Freed by task 6058: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kfree+0x14f/0x4b0 mm/slub.c:4727 hackrf_probe+0x4c9/0x1cf0 drivers/media/usb/hackrf/hackrf.c:1525 usb_probe_interface+0x309/0x9d0 drivers/usb/core/driver.c:399 ... Reported-and-tested-by: syzbot+6b52c2b24e341804a58c@xxxxxxxxxxxxxxxxxxxxxxxxx Closes: https://syzkaller.appspot.com/bug?extid=6b52c2b24e341804a58c Fixes: 8bc4a9ed8504 ("[media] hackrf: add support for transmitter") Cc: stable@xxxxxxxxxxxxxxx Signed-off-by: Nikita Zhandarovich <n.zhandarovich@xxxxxxxxxx> --- P.S. since my setup failed to reliably test both the repro and the patch locally, I had to rely exclusively on syzbot capabilities. At the moment this patch is being sent, syzkaller seems to be acting out though... drivers/media/usb/hackrf/hackrf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/usb/hackrf/hackrf.c b/drivers/media/usb/hackrf/hackrf.c index 0b50de8775a3..bc910b35f605 100644 --- a/drivers/media/usb/hackrf/hackrf.c +++ b/drivers/media/usb/hackrf/hackrf.c @@ -1513,12 +1513,12 @@ static int hackrf_probe(struct usb_interface *intf, return 0; err_video_unregister_device_rx: video_unregister_device(&dev->rx_vdev); -err_v4l2_device_unregister: - v4l2_device_unregister(&dev->v4l2_dev); err_v4l2_ctrl_handler_free_tx: v4l2_ctrl_handler_free(&dev->tx_ctrl_handler); err_v4l2_ctrl_handler_free_rx: v4l2_ctrl_handler_free(&dev->rx_ctrl_handler); +err_v4l2_device_unregister: + v4l2_device_unregister(&dev->v4l2_dev); err_kfree: kfree(dev); err:
