[PATCH v2] media: usbtv: fix use-after-free and lockdep panic on unbind

[PATCH v2] media: usbtv: fix use-after-free and lockdep panic on unbind

[Svyatoslav Nikolenko]

When a usbtv device is unplugged or unbound, a lockdep panic and
use-after-free occurs in the driver core.

The sequence of events leading to the crash is:
1. device_release_driver_internal() acquires dev->mutex.
2. usbtv_disconnect() is called, which in turn calls usbtv_video_free().
3. usbtv_video_free() prematurely calls v4l2_device_disconnect() and
   v4l2_device_put().
4. This drops the final reference on the parent USB device (intf->dev),
   triggering synchronous device deletion while the USB core is still
   holding dev->mutex.
5. When the core attempts to unlock dev->mutex, it operates on freed
   memory, causing a lockdep panic.

Furthermore, usbtv_disconnect() continues to access usbtv->udev after
usbtv_video_free() returns, leading to a direct use-after-free.

Note that commit cb705f75d03e ("media: usbtv: fix null-pointer
dereference on disconnect") recently added a mutex to usbtv_video_free()
to resolve a separate issue, but left the premature v4l2_device calls
intact. Because the final reference is still dropped too early, the
lockdep panic still occurs.

Fix this by removing the manual v4l2_device_disconnect() and
v4l2_device_put() calls from usbtv_video_free(). This allows
usbtv_video_free() to safely unregister the video node without destroying
the underlying structures. The final v4l2_device_put() at the end of
usbtv_disconnect() will now correctly trigger usbtv_release()
asynchronously, safely dropping the parent device reference only after all
system locks are released.

As a result of this cleanup, the dummy v4l2_device_get() previously used
to prevent premature deletion in the usbtv_probe() error path is no longer
needed and has been removed.

Fixes: a3550ea665ac ("[media] usbtv: split core and video implementation")
Reported-by: syzbot+ed3ed4f52d1fb6a7367d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ed3ed4f52d1fb6a7367d
Tested-by: syzbot+ed3ed4f52d1fb6a7367d@syzkaller.appspotmail.com
Signed-off-by: Svyatoslav Nikolenko <nsvatoslav515@gmail.com>
---
Changes in v2:
- Rebased onto media-committers/next.
- Updated commit message to clarify why commit cb705f75d03e does not 
  resolve this specific lockdep panic.

 drivers/media/usb/usbtv/usbtv-core.c  | 3 ---
 drivers/media/usb/usbtv/usbtv-video.c | 3 ---
 2 files changed, 6 deletions(-)

diff --git a/drivers/media/usb/usbtv/usbtv-core.c b/drivers/media/usb/usbtv/usbtv-core.c
index 89c3424e7685..2cd982ca49bf 100644
--- a/drivers/media/usb/usbtv/usbtv-core.c
+++ b/drivers/media/usb/usbtv/usbtv-core.c
@@ -112,9 +112,6 @@ static int usbtv_probe(struct usb_interface *intf,
 	return 0;
 
 usbtv_audio_fail:
-	/* we must not free at this point */
-	v4l2_device_get(&usbtv->v4l2_dev);
-	/* this will undo the v4l2_device_get() */
 	usbtv_video_free(usbtv);
 
 usbtv_video_fail:
diff --git a/drivers/media/usb/usbtv/usbtv-video.c b/drivers/media/usb/usbtv/usbtv-video.c
index 2a91af8d1e30..999bce621c04 100644
--- a/drivers/media/usb/usbtv/usbtv-video.c
+++ b/drivers/media/usb/usbtv/usbtv-video.c
@@ -964,11 +964,8 @@ int usbtv_video_init(struct usbtv *usbtv)
 void usbtv_video_free(struct usbtv *usbtv)
 {
 	vb2_video_unregister_device(&usbtv->vdev);
-	v4l2_device_disconnect(&usbtv->v4l2_dev);
 
 	mutex_lock(&usbtv->v4l2_lock);
 	usbtv->udev = NULL;
 	mutex_unlock(&usbtv->v4l2_lock);
-
-	v4l2_device_put(&usbtv->v4l2_dev);
 }
-- 
2.47.3