[PATCH] media: em28xx: fix use-after-free of dev_next in em28xx_close_extension()

[PATCH] media: em28xx: fix use-after-free of dev_next in em28xx_close_extension()

[Diego Fernando Mancera Gomez]

For dual-TS devices em28xx_usb_probe() creates a second em28xx instance,
dev->dev_next, and initialises it with em28xx_init_dev(), which adds it
to em28xx_devlist via em28xx_init_extension() (list_add_tail()).

On disconnect em28xx_usb_disconnect() calls em28xx_close_extension(dev),
which only unlinks the primary device from the list:

	list_del(&dev->devlist);

and then frees dev->dev_next (kref_put() -> em28xx_free_device() ->
kfree()). The second device is therefore freed while it is still linked
into em28xx_devlist, leaving a dangling node behind. A later walk of
em28xx_devlist - for instance another device being unlinked in
em28xx_close_extension() during its own disconnect - then dereferences the
freed entry:

  BUG: KASAN: use-after-free in __list_del_entry_valid_or_report+0x1d4/0x200
  Read of size 8 at addr ffff888047254250 by task kworker/0:4/6312
  ...
   __list_del_entry_valid_or_report+0x1d4/0x200
   em28xx_close_extension+0x10b/0x2b0
   em28xx_usb_disconnect+0x19d/0x610
   usb_unbind_interface+0x1dd/0x9e0
   ...
   hub_event+0x1d81/0x5360

  Freed by em28xx_usb_disconnect() (kfree() of the dev_next allocated with
  kmemdup() in em28xx_usb_probe()).

Unlink dev->dev_next from em28xx_devlist as well before it is freed.

Reported-by: syzbot+a11c46f37ee083a73deb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a11c46f37ee083a73deb
Fixes: 4a089668ef22 ("media: em28xx-cards: rework the em28xx probing code")
Signed-off-by: Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com>
---
 drivers/media/usb/em28xx/em28xx-core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c
index 5bbb082dbed9..3d6b196b8483 100644
--- a/drivers/media/usb/em28xx/em28xx-core.c
+++ b/drivers/media/usb/em28xx/em28xx-core.c
@@ -1265,6 +1265,8 @@ void em28xx_close_extension(struct em28xx *dev)
 			ops->fini(dev);
 		}
 	}
+	if (dev->dev_next)
+		list_del(&dev->dev_next->devlist);
 	list_del(&dev->devlist);
 	mutex_unlock(&em28xx_devlist_mutex);
 }
-- 
2.43.0