[PATCH] media: dvb-core: avoid dropping device ref on frontend open failure

[PATCH] media: dvb-core: avoid dropping device ref on frontend open failure

[Yousef Alhouseen]

dvb_device_open() takes a device reference before calling the frontend
open callback and drops that reference itself if the callback fails.
However, the frontend error path calls dvb_generic_release(), which drops
the same reference while merely trying to undo the user counters changed
by dvb_generic_open(). A concurrent device unregister can leave this as
the final reference, so the subsequent dvbdev->users access is a
use-after-free. The outer open path then also performs a second put.

Restore the writer and user counters directly. The reference remains
owned by dvb_device_open(), which will release it after the callback
returns the error.

Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF")
Reported-by: syzbot+40339ea82afa8184ad5d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=40339ea82afa8184ad5d
Cc: stable@vger.kernel.org
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
---
 drivers/media/dvb-core/dvb_frontend.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
index d082b6c57c76..7aebaef18191 100644
--- a/drivers/media/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb-core/dvb_frontend.c
@@ -2887,7 +2887,8 @@ static int dvb_frontend_open(struct inode *inode, struct file *file)
 	mutex_unlock(&fe->dvb->mdev_lock);
 err2:
 #endif
-	dvb_generic_release(inode, file);
+	dvbdev->writers++;
+	dvbdev->users++;
 err1:
 	if (dvbdev->users == -1 && fe->ops.ts_bus_ctrl)
 		fe->ops.ts_bus_ctrl(fe, 0);
-- 
2.54.0