From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7FBCB1C860A for ; Sun, 28 Jun 2026 09:19:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782638373; cv=none; b=tGWcaQbuUPS+NkgqGhBhh4fuug5tBAKJR0MbL2TnLl0VG0Xy2iqcuY8MOZfnoHkm9kZ901sc7io3xmrNvdqIzs/CNDfp76dWGF+TozsgVUFlj8uaSRGpXmp02Qwn0bVJVbHB36wXmOVxMzCtvwMaKzRG3ZdPjArBEMu1MqoSldU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782638373; c=relaxed/simple; bh=+TMcaHn5YQykUzQzJACoD9w3PjSFRZHmSBneHv5oR0o=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=pGhfk2YDCy0S77+4H3Cyuhue+JA5TbNhCbSlleuZ4umSrm3WVcJ1qLVG1qonu582SCTCDgdS6sfA7n5c/YuCorRCaTtqyzXeR88Vgzm+kdmLINJDoU74OYxkEnEbsjaSe9ceAt+NMMZ0v9yhyosWSzTC4Z/f44pOMokGb1iloKA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=S/sfpgFt; arc=none smtp.client-ip=209.85.128.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="S/sfpgFt" Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-49241896317so12826765e9.3 for ; Sun, 28 Jun 2026 02:19:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782638369; x=1783243169; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=AMFPxxbKwC83QNnr+scrjS2pM+xu1i6gm24bZDXkabo=; b=S/sfpgFtfzoyqQAOh3BYPNNmOys4f1KeDYChh3amm9XmUBoLv7li7uOQyq3tXfGQn8 HoLBKdMXbUrjxzixHNxRPGi7FlAz+4vYWPeB+BqtXCL/ANG4qYGKX4AiJvejPwuczhSx fZB4HM3xOrOPvE+WWnzWbVLCqLfr/kwBl0brQixDxbTuzOUPTEpHSswCzXn2dmDWRZ/2 wv/Fhz+n5LGmU2RWUF+zQe5dak9WbYjA79HUjjn8UHQFMbp3Tpk3bjiD5R7ftIGIsJCn pgF97h8Z1VgycAYkh4oW6xHMiN815WbetsFN/q2UqiemI1RC2k6SpuB4BHK9DAitGbso HesA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782638369; x=1783243169; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=AMFPxxbKwC83QNnr+scrjS2pM+xu1i6gm24bZDXkabo=; b=dK1bQ0vppQUJ8/nX/gtm4mkYgIvB9R5Ev7rWavnMznjioQbe2Q43GWtZd3Rfqd3WLs MEVpkESC1GVAv5UqosyffK1UUebnT6wJySRMkHmGin6WoL2SEpnBp4axtN77uPnUSbtH Vs5LwoFT3pHGEQUDX+szBqcFtwE+5eB/2Ejo38wCNccXsrgr40mVSx4edOTBwwTV9iUb 1Au+NMorCKVQfJHm9jDKX9RMmO0LuOdc/6KqXYxbCNEWwb9geRKGK+T5NvSZTCw4hA3k 2nQGCpB6vR2omgIKipYUhwZlUKXMw0uirWsGhVXrJuQRbbRgbCSQFoP6Mw85TcQxrO+p S8+g== X-Forwarded-Encrypted: i=1; AFNElJ9gPh5IjhwWs+MIr6Fuz+vnWlPXfgiomWVecyYs9CytsZ9IAXfPwdLGuHfCH3BGSVMLx8hEltV+HmAFflo=@vger.kernel.org X-Gm-Message-State: AOJu0Yw6sTLi7Kp5fIyzyaJ3Bz+gBugwNsN0Ag8DIfPBZPREupwZgCT6 LXkjCaaB+0+zfJA+NfTFHUdrrgJpSU4Q8oSS4aVTkHEYcdP04bCZkUZH X-Gm-Gg: AfdE7cmQyWzgzyNUKWj5sKp1vFzUItYT3mO3hDLl8JQp/XFxqcRSynMSd9ex7n+CeTV BrGdbRvIlkrDJ+c1Y939+6lA58X9g5Ow3fF9LHmZObE2nKLPtUv+DjYNXX+++3kP0oArxa/wnXd WMrE5QgdNWshRRKXbPsUB19DnIg+iXrXs6s9hqg8NosvbWtUpeKh0Rtgn1uQsMGzRw71ic1M4Gb /3Q7A37Ue+Zi73RzK6HHwjXm4X3UJULe/h0WIJCa/rJJ1FIrPdVbUOQEpy8c4Cc2tW5n2Z+OSSy vV8beC/6KsRbhlgeFAEI1sP+YgTXMaG28OeEOqLZPTPImt85qe+HxGhavypPzEOiA/uR2CEhOyW BbzITbbgZZYgmNAGnZZG8Bk4Lwq15jylKIkyHLLUfckoJjg5sP9h84tYdbJT4e2PCuwnv4CMk0x EwloWres0sksc27afKHUyJyl92Fw== X-Received: by 2002:a05:600c:1d1e:b0:492:2f3c:d0ed with SMTP id 5b1f17b1804b1-4926688a528mr186302095e9.30.1782638368707; Sun, 28 Jun 2026 02:19:28 -0700 (PDT) Received: from Dev-Null-MSI ([2a0d:3344:52ac:a808:98a4:4381:be45:536f]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4926c28673dsm187757565e9.2.2026.06.28.02.19.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 28 Jun 2026 02:19:27 -0700 (PDT) From: Yousef Alhouseen To: Mauro Carvalho Chehab Cc: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, syzbot+40339ea82afa8184ad5d@syzkaller.appspotmail.com, Yousef Alhouseen Subject: [PATCH] media: dvb-core: avoid dropping device ref on frontend open failure Date: Sun, 28 Jun 2026 11:18:44 +0200 Message-ID: <20260628091844.37577-1-alhouseenyousef@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit dvb_device_open() takes a device reference before calling the frontend open callback and drops that reference itself if the callback fails. However, the frontend error path calls dvb_generic_release(), which drops the same reference while merely trying to undo the user counters changed by dvb_generic_open(). A concurrent device unregister can leave this as the final reference, so the subsequent dvbdev->users access is a use-after-free. The outer open path then also performs a second put. Restore the writer and user counters directly. The reference remains owned by dvb_device_open(), which will release it after the callback returns the error. Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF") Reported-by: syzbot+40339ea82afa8184ad5d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=40339ea82afa8184ad5d Cc: stable@vger.kernel.org Signed-off-by: Yousef Alhouseen --- drivers/media/dvb-core/dvb_frontend.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c index d082b6c57c76..7aebaef18191 100644 --- a/drivers/media/dvb-core/dvb_frontend.c +++ b/drivers/media/dvb-core/dvb_frontend.c @@ -2887,7 +2887,8 @@ static int dvb_frontend_open(struct inode *inode, struct file *file) mutex_unlock(&fe->dvb->mdev_lock); err2: #endif - dvb_generic_release(inode, file); + dvbdev->writers++; + dvbdev->users++; err1: if (dvbdev->users == -1 && fe->ops.ts_bus_ctrl) fe->ops.ts_bus_ctrl(fe, 0); -- 2.54.0