[PATCH] media: as102: initialize bus_adap.lock and sem mutexes before DVB registration

[PATCH] media: as102: initialize bus_adap.lock and sem mutexes before DVB registration

[Rohinthan P]

In as102_dvb_register(), mutex_init(&as102_dev->bus_adap.lock) and
mutex_init(&as102_dev->sem) are called at the end of the function,
after dvb_register_frontend() has already registered the frontend
device node to userspace.

If userspace opens the frontend node immediately after registration,
dvb_frontend_open() invokes fe->ops.ts_bus_ctrl(fe, 1), which calls
as102_stream_ctrl(). In as102_stream_ctrl(), bus_adap->lock is acquired
via mutex_lock_interruptible(&bus_adap->lock). Because the mutex has
not yet been initialized, DEBUG_LOCKS_WARN_ON(lock->magic != lock) is
triggered:

  DEBUG_LOCKS_WARN_ON(lock->magic != lock)
  WARNING: kernel/locking/mutex.c:625 at __mutex_lock+0x12d8/0x1550
  ...
  Call Trace:
   <TASK>
   as102_stream_ctrl+0x27/0xc0 drivers/media/usb/as102/as102_drv.c:259
   dvb_frontend_open+0x7e2/0x1410 drivers/media/dvb-core/dvb_frontend.c:2825
   dvb_device_open+0x24f/0x340 drivers/media/dvb-core/dvbdev.c:109
   chrdev_open+0x4d9/0x600 fs/char_dev.c:411

Similarly, as102_dev->sem protects starting and stopping feeds via
as102_dvb_dmx_start_feed() / as102_dvb_dmx_stop_feed(), and was also
initialized after the demux device was initialized and frontend
registered.

Move mutex_init() for both bus_adap.lock and sem to the beginning of
as102_dvb_register(), ensuring that the mutexes are initialized before
the adapter, demux, or frontend are exposed to userspace.

Fixes: 47f79129ecf5 ("[media] as102: prepare as102_fe to be compiled as a module")
Reported-by: syzbot+ea047a32630b1f47da67@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ea047a32630b1f47da67
Signed-off-by: Rohinthan P <rokinthanp03@gmail.com>
---
 drivers/media/usb/as102/as102_drv.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/media/usb/as102/as102_drv.c b/drivers/media/usb/as102/as102_drv.c
index 6b1d352..a6dd675 100644
--- a/drivers/media/usb/as102/as102_drv.c
+++ b/drivers/media/usb/as102/as102_drv.c
@@ -287,6 +287,12 @@ int as102_dvb_register(struct as102_dev_t *as102_dev)
 	struct device *dev = &as102_dev->bus_adap.usb_dev->dev;
 	int ret;
 
+	/* init bus mutex for token locking */
+	mutex_init(&as102_dev->bus_adap.lock);
+
+	/* init start / stop stream mutex */
+	mutex_init(&as102_dev->sem);
+
 	ret = dvb_register_adapter(&as102_dev->dvb_adap,
 			   as102_dev->name, THIS_MODULE,
 			   dev, adapter_nr);
@@ -341,12 +347,6 @@ int as102_dvb_register(struct as102_dev_t *as102_dev)
 		goto efereg;
 	}
 
-	/* init bus mutex for token locking */
-	mutex_init(&as102_dev->bus_adap.lock);
-
-	/* init start / stop stream mutex */
-	mutex_init(&as102_dev->sem);
-
 	/*
 	 * try to load as102 firmware. If firmware upload failed, we'll be
 	 * able to upload it later.
-- 
2.53.0