From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 62CBB288C3D for ; Sun, 28 Jun 2026 09:42:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782639776; cv=none; b=NPkSex7LepKhRSIwYZRamxb0b3LL17X1fAGVGv89xBy03VE68CJ5610zOtwVMo+yEKxVnwxgIYb0VawkrPP4w5s/y3Z52ZoxLWiMM4pDyV6X+8/OaJc7kOdQW+ZSJgh95HyE2E7FJZtrjv3ronxNq41OK7byErKNxkQgvinOCDY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782639776; c=relaxed/simple; bh=mhmLXscI6NQQEl70eju7+aXlhtGYE6nMOBb0I5fNLNs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=p9FQS/XWn5t+MV0/3omu8DAF4AwviQ5QsMYctBR8NVfBhqGVUnC75UGjnOhgDJwwKw5FDLfdxi1sorUHgVa4h+g5RAmkg/3iIljQqpz/qTsiIsOExezZH8U+bc7qyJfgBVmPd29ZaoAZCpYLQ284F6hMFo8shDTCBh7tn3fMlE8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=SlOB/FPY; arc=none smtp.client-ip=209.85.128.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="SlOB/FPY" Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-49249707788so19338965e9.2 for ; Sun, 28 Jun 2026 02:42:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782639774; x=1783244574; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=UqVt+RIteYYvNTCyf7JhD0K57WM4+XbG2izcVTYOpIA=; b=SlOB/FPYrV9b2whuUJSJc+ra4YuukppavegQRSdIaCA667GrgMn7BRmrnmcbbxCU1S Mwy0bWmhoQkB4t9Z9ZS5WNIdZxG2/sjMurfrk/tuMSeCF/NdfZdR7bVZ3FVckoGfwNAD SFWK1QfMVcf53nTThG2QH986ZlcXUnSSLRv3s8mbNxueI1/Boh/+qJOR+/x5CNCkrUpb u1uxm8P1Rq49ruEG1L9ZN2MsjVFFy21gHx2MV62B/vk/kAnycB5uRABnL/h+gCTr6VOP Mr3V/bfq5MPSwYwnbgYVEN1+AibVaFjRirO9Xs+NqjiFScSBO84kenigy4yykRWhs6RV 99wA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782639774; x=1783244574; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=UqVt+RIteYYvNTCyf7JhD0K57WM4+XbG2izcVTYOpIA=; b=mP2sn1xko3hwJtSNT97OZ0nw/pg+F/HiQqOWnHGpc47I7Z8N0pz/rOWH+XAL0mkK3v gl2VdSSryXQUqjfzJnDTsYJLWy28UeKL3OW1ZZFmC9O9bEWWSiOPe7bo5Nksthct+Zjk eVZzEbqUPYAdXXOdrKR8Bh99ZogUpUC1jMJsofwMih7Qk6+0RzbUw+gUm8vkR7nLk7uk Ga62NJwUWmHBp+Oeg3HLBls0ecBndcPQp3RE6pxSJzTA1CrEALqfvzdjvPu9uCfKy9G1 1MIiZx4B+MCfqGuanRA0vMa1ZHu1IZxROYdxsfQ4yBDOwelYXjwIw5LtIidQqme6ESPT mE6w== X-Forwarded-Encrypted: i=1; AFNElJ9jAU5d7pPbywN+CrHD8oZ3PjeriXPmrA6Sg1S+LYpkScGaY2PeUcOTL28jiChMkLEF6ttexBU+dzWM+0g=@vger.kernel.org X-Gm-Message-State: AOJu0YyxuPWPYll8LuT4QzXtHIHBxl1tfsSqcSh6wsYwLpjGzHTRAnlS 8IyIRRwjz456Y0RZOHMPSlNOnlqq/vvOAN/oD87KY9ds307Diy1WFMIo X-Gm-Gg: AfdE7ckvxNbrmp9zlDFHfswi+BgK7lR/vEBVY3asAVPGABzZ+R9CpsFkiu6oJX+Ugz4 wtyQzfaN/IVzkloDpa2fJxBxJWldXbiy96niUCD04/OMWasSeu4hdxXJiEsAh8JGvTK1lEHEFL3 K7c2s/WAqRFdWNLxswpO+S6ftYtBbk269ws1pUWax2gkHSYsJxFyrrAOMwwckw7ynr/+rLi540c LX2vIc4gC57gjvDei+mtlbV/t77ZpjeNaP9mMOf7AcjFFCKR5CYsNRvVmCinrWFl+FORYT+xO9c ANliOvt4DigQo/GMkX1TrfdYl+mlT+sFzvnK2DTvAGuc98M4kxsWaqsjdMrUg27R+16WLBEV6GP b8uWPJs4BzB5DPdod8rXu9PSKhwLVLQbe/pqPgmCv2P5X9Av/U6k1q3BdsREu0qkjXHlNBX4CXP uBjXqO5YtKhWPB5U8SCLlSr7cTvw== X-Received: by 2002:a05:600c:4f83:b0:492:d8be:2c0f with SMTP id 5b1f17b1804b1-49398cd4600mr62591975e9.36.1782639773581; Sun, 28 Jun 2026 02:42:53 -0700 (PDT) Received: from Dev-Null-MSI ([2a0d:3344:52ac:a808:98a4:4381:be45:536f]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4926c28c51asm121739045e9.2.2026.06.28.02.42.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 28 Jun 2026 02:42:52 -0700 (PDT) From: Yousef Alhouseen To: Mauro Carvalho Chehab Cc: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, syzbot+ae466a728017ec940b41@syzkaller.appspotmail.com, Yousef Alhouseen Subject: [PATCH] media: dvb-core: pin frontend device through release Date: Sun, 28 Jun 2026 11:42:05 +0200 Message-ID: <20260628094205.44981-1-alhouseenyousef@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit dvb_generic_release() drops the reference held by the open file. Device unregistration may already have dropped the registration reference, in which case the call frees dvbdev. dvb_frontend_release() nevertheless continues to inspect its user count, wait queue, media entity and private frontend after that call, causing a use-after-free. Take a temporary device reference around the generic release and the remaining frontend shutdown work. Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF") Reported-by: syzbot+ae466a728017ec940b41@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ae466a728017ec940b41 Cc: stable@vger.kernel.org Signed-off-by: Yousef Alhouseen --- drivers/media/dvb-core/dvb_frontend.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c index 7aebaef18191..1276fe704675 100644 --- a/drivers/media/dvb-core/dvb_frontend.c +++ b/drivers/media/dvb-core/dvb_frontend.c @@ -2912,6 +2912,7 @@ static int dvb_frontend_release(struct inode *inode, struct file *file) mb(); } + dvb_device_get(dvbdev); ret = dvb_generic_release(inode, file); if (dvbdev->users == -1) { @@ -2933,6 +2934,7 @@ static int dvb_frontend_release(struct inode *inode, struct file *file) } dvb_frontend_put(fe); + dvb_device_put(dvbdev); return ret; } -- 2.54.0