[PATCH] media: dvb-core: fix use-after-free in dvb_remove_device()

[PATCH] media: dvb-core: fix use-after-free in dvb_remove_device()

[Joas Antonio dos Santos via B4 Relay]

From: Joas Antonio dos Santos <joasantonio108@gmail.com>

dvb_remove_device() calls dvb_device_put() while still holding and
using the dvb_device pointer.  If the put drops the last reference,
dvb_free_device() kfrees the struct, and the subsequent calls to
dvb_media_device_free(), device_destroy(), and list_del() all operate
on freed memory.

The syzbot KASAN report shows the freed kmalloc-256 object being read
at dvb_media_device_free()+0x3a, which dereferences dvbdev->entity
(dvbdev.c:210) after dvb_device_put() in dvb_remove_device() already
freed it via dvb_free_device().

Fix by saving the minor number before releasing the reference and
moving dvb_device_put() to after all accesses to the dvb_device
struct.  This ensures the device remains valid for the entire cleanup
sequence regardless of the reference count.

Found by LLM-assisted code review of syzbot-reported crash patterns.

Reported-by: syzbot+37578f730d38898f4b74@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=37578f730d38898f4b74
Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF")
Cc: stable@vger.kernel.org
Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>
---
 drivers/media/dvb-core/dvbdev.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c
index d753d3295..b2beacbab 100644
--- a/drivers/media/dvb-core/dvbdev.c
+++ b/drivers/media/dvb-core/dvbdev.c
@@ -593,19 +593,22 @@ EXPORT_SYMBOL(dvb_register_device);
 
 void dvb_remove_device(struct dvb_device *dvbdev)
 {
+	int minor;
+
 	if (!dvbdev)
 		return;
 
+	minor = dvbdev->minor;
+
 	down_write(&minor_rwsem);
-	dvb_minors[dvbdev->minor] = NULL;
-	dvb_device_put(dvbdev);
+	dvb_minors[minor] = NULL;
 	up_write(&minor_rwsem);
 
 	dvb_media_device_free(dvbdev);
-
-	device_destroy(dvb_class, MKDEV(DVB_MAJOR, dvbdev->minor));
-
+	device_destroy(dvb_class, MKDEV(DVB_MAJOR, minor));
 	list_del(&dvbdev->list_head);
+
+	dvb_device_put(dvbdev);
 }
 EXPORT_SYMBOL(dvb_remove_device);
 

---
base-commit: ebcf66fba448879076bfdd1018ac5cda37b912bf
change-id: 20261105-dvb-remove-device-uaf-aea34136c515

Best regards,
-- 
Joas Antonio dos Santos <joasantonio108@gmail.com>