[PATCH] media: imon: fix use-after-free in display_close via dev_dbg

[PATCH] media: imon: fix use-after-free in display_close via dev_dbg

[Deepanshu Kartikey]

ictx->dev is a raw pointer to the usb_interface's embedded device.
On disconnect, usb_disconnect() can drop the last reference on the
interface and free it while a userspace fd for /dev/lcd0 is still
open. When that fd is later closed, display_close() dereferences
the now-freed ictx->dev via dev_dbg(), causing a use-after-free.

Remove the dev_dbg() calls that dereference ictx->dev in
display_close() and free_imon_context(), rather than taking a
reference on the device.

Fixes: 21677cfc562a ("V4L/DVB: ir-core: add imon driver")
Reported-by: syzbot+9bfac891bdd42eb708fc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9bfac891bdd42eb708fc
Link: https://lore.kernel.org/all/20260918054851.26083-1-kartikey406@gmail.com/T/ [v1]
Link: https://lore.kernel.org/all/20260928121230.35359-1-kartikey406@gmail.com/T/ [v2]
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
v3:
- Drop the dev_dbg() calls entirely instead of pinning the device
  with get_device()/put_device(), per Sean Young.

v2:
- Remove the dev_dbg() in free_imon_context(), as suggested by
  Sean Young.
---
 drivers/media/rc/imon.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index 049a73b5f882..e54b588ff61c 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -492,16 +492,12 @@ MODULE_PARM_DESC(pad_thresh, "Threshold at which a pad push registers as an arro
 
 static void free_imon_context(struct imon_context *ictx)
 {
-	struct device *dev = ictx->dev;
-
 	usb_free_urb(ictx->tx_urb);
 	WARN_ON(ictx->dev_present_intf0);
 	usb_free_urb(ictx->rx_urb_intf0);
 	WARN_ON(ictx->dev_present_intf1);
 	usb_free_urb(ictx->rx_urb_intf1);
 	kfree_rcu(ictx, rcu);
-
-	dev_dbg(dev, "%s: iMON context freed\n", __func__);
 }
 
 /*
@@ -577,7 +573,6 @@ static int display_close(struct inode *inode, struct file *file)
 		retval = -EIO;
 	} else {
 		ictx->display_isopen = false;
-		dev_dbg(ictx->dev, "display port closed\n");
 	}
 
 	mutex_unlock(&ictx->lock);
-- 
2.43.0

Re: [PATCH] media: imon: fix use-after-free in display_close via dev_dbg

[Deepanshu Kartikey]

On Sat, Sep 26, 2026 at 5:26 PM Sean Young <sean@mess.org> wrote:
>
> On Fri, Sep 18, 2026 at 11:18:51AM +0530, Deepanshu Kartikey wrote:
> > ictx->dev is a raw pointer to the usb_interface's embedded device,
> > cached in imon_init_intf0() without taking a reference. On
> > disconnect, usb_disconnect() can drop the last reference on the
> > interface and free it while a userspace fd for /dev/lcd0 is still
> > open. When that fd is later closed, display_close() dereferences
> > the now-freed ictx->dev via dev_dbg(), causing a use-after-free.
> >
> > Fix by pinning the device with get_device() when ictx->dev is
> > assigned, and releasing it with put_device() when ictx is freed.
> >
> > Fixes: 21677cfc562a ("V4L/DVB: ir-core: add imon driver")
> > Reported-by: syzbot+9bfac891bdd42eb708fc@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=9bfac891bdd42eb708fc
> > Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> > ---
> >  drivers/media/rc/imon.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
> > index 049a73b5f882..9341dbe03b57 100644
> > --- a/drivers/media/rc/imon.c
> > +++ b/drivers/media/rc/imon.c
> > @@ -502,6 +502,7 @@ static void free_imon_context(struct imon_context *ictx)
> >       kfree_rcu(ictx, rcu);
> >
> >       dev_dbg(dev, "%s: iMON context freed\n", __func__);
>
> The dev is only referenced in dev_dbg() here.
>
> The debug statement is pretty pointless anyway so why don't we remove
> that instead.
>
>
> Sean

I misunderstood your last message.

The reported crash is in display_close(), and
ictx->dev is also passed to dev_dbg() in display_open() and lcd_write(),
which can run after disconnect. Removing only the dev_dbg() in
free_imon_context() would not fix the bug.


Do you want me to replace dev_dbg from all over the place ?

Thanks

Re: [PATCH] media: imon: fix use-after-free in display_close via dev_dbg

[Deepanshu Kartikey]

On Sat, Sep 26, 2026 at 5:26 PM Sean Young <sean@mess.org> wrote:
>
>
> The debug statement is pretty pointless anyway so why don't we remove
> that instead.
>
>

Sure, I will remove this and send patch v2

Thanks

Deepanshu

Re: [PATCH] media: imon: fix use-after-free in display_close via dev_dbg

[Sean Young]

On Fri, Sep 18, 2026 at 11:18:51AM +0530, Deepanshu Kartikey wrote:
> ictx->dev is a raw pointer to the usb_interface's embedded device,
> cached in imon_init_intf0() without taking a reference. On
> disconnect, usb_disconnect() can drop the last reference on the
> interface and free it while a userspace fd for /dev/lcd0 is still
> open. When that fd is later closed, display_close() dereferences
> the now-freed ictx->dev via dev_dbg(), causing a use-after-free.
> 
> Fix by pinning the device with get_device() when ictx->dev is
> assigned, and releasing it with put_device() when ictx is freed.
> 
> Fixes: 21677cfc562a ("V4L/DVB: ir-core: add imon driver")
> Reported-by: syzbot+9bfac891bdd42eb708fc@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=9bfac891bdd42eb708fc
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
>  drivers/media/rc/imon.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
> index 049a73b5f882..9341dbe03b57 100644
> --- a/drivers/media/rc/imon.c
> +++ b/drivers/media/rc/imon.c
> @@ -502,6 +502,7 @@ static void free_imon_context(struct imon_context *ictx)
>  	kfree_rcu(ictx, rcu);
>  
>  	dev_dbg(dev, "%s: iMON context freed\n", __func__);

The dev is only referenced in dev_dbg() here.

The debug statement is pretty pointless anyway so why don't we remove
that instead.


Sean

> +	put_device(dev);
>  }
>  
>  /*
> @@ -2253,7 +2254,7 @@ static struct imon_context *imon_init_intf0(struct usb_interface *intf,
>  
>  	mutex_lock(&ictx->lock);
>  
> -	ictx->dev = dev;
> +	ictx->dev = get_device(dev);
>  	ictx->usbdev_intf0 = interface_to_usbdev(intf);
>  	ictx->rx_urb_intf0 = rx_urb;
>  	ictx->tx_urb = tx_urb;
> @@ -2314,6 +2315,7 @@ static struct imon_context *imon_init_intf0(struct usb_interface *intf,
>  find_endpoint_failed:
>  	mutex_unlock(&ictx->lock);
>  	usb_free_urb(tx_urb);
> +	put_device(ictx->dev);
>  tx_urb_alloc_failed:
>  	usb_free_urb(rx_urb);
>  rx_urb_alloc_failed:
> -- 
> 2.34.1
> 

[PATCH] media: imon: fix use-after-free in display_close via dev_dbg

[Deepanshu Kartikey]

ictx->dev is a raw pointer to the usb_interface's embedded device,
cached in imon_init_intf0() without taking a reference. On
disconnect, usb_disconnect() can drop the last reference on the
interface and free it while a userspace fd for /dev/lcd0 is still
open. When that fd is later closed, display_close() dereferences
the now-freed ictx->dev via dev_dbg(), causing a use-after-free.

Fix by pinning the device with get_device() when ictx->dev is
assigned, and releasing it with put_device() when ictx is freed.

Fixes: 21677cfc562a ("V4L/DVB: ir-core: add imon driver")
Reported-by: syzbot+9bfac891bdd42eb708fc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9bfac891bdd42eb708fc
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/media/rc/imon.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index 049a73b5f882..9341dbe03b57 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -502,6 +502,7 @@ static void free_imon_context(struct imon_context *ictx)
 	kfree_rcu(ictx, rcu);
 
 	dev_dbg(dev, "%s: iMON context freed\n", __func__);
+	put_device(dev);
 }
 
 /*
@@ -2253,7 +2254,7 @@ static struct imon_context *imon_init_intf0(struct usb_interface *intf,
 
 	mutex_lock(&ictx->lock);
 
-	ictx->dev = dev;
+	ictx->dev = get_device(dev);
 	ictx->usbdev_intf0 = interface_to_usbdev(intf);
 	ictx->rx_urb_intf0 = rx_urb;
 	ictx->tx_urb = tx_urb;
@@ -2314,6 +2315,7 @@ static struct imon_context *imon_init_intf0(struct usb_interface *intf,
 find_endpoint_failed:
 	mutex_unlock(&ictx->lock);
 	usb_free_urb(tx_urb);
+	put_device(ictx->dev);
 tx_urb_alloc_failed:
 	usb_free_urb(rx_urb);
 rx_urb_alloc_failed:
-- 
2.34.1