Re: [PATCH] media: vidtv: fix mutex use-after-destroy in vidtv_bridge_remove()

Re: [PATCH] media: vidtv: fix mutex use-after-destroy in vidtv_bridge_remove()

[syzbot]

> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

This crash does not have a reproducer. I cannot test it.

>
>
> mutex_destroy(&dvb->feed_lock) is called too early in
> vidtv_bridge_remove(), before dvb_dmxdev_release() and
> dvb_dmx_release(). Both of these can still trigger vidtv_stop_feed(),
> which locks feed_lock, causing DEBUG_LOCKS_WARN_ON(lock->magic !=
> lock) in __mutex_lock().
>
> Fix by moving mutex_destroy() to after dvb_dmxdev_release() and
> dvb_dmx_release() return, and by stopping any active streaming under
> feed_lock beforehand so a late vidtv_stop_feed() call sees
> dvb->streaming == false and returns early.
>
> Reported-by: syzbot+3157015c6bd85395cddc@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=3157015c6bd85395cddc
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
>  drivers/media/test-drivers/vidtv/vidtv_bridge.c | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/media/test-drivers/vidtv/vidtv_bridge.c b/drivers/media/test-drivers/vidtv/vidtv_bridge.c
> index fd69b4ee16f4..6bebf4617100 100644
> --- a/drivers/media/test-drivers/vidtv/vidtv_bridge.c
> +++ b/drivers/media/test-drivers/vidtv/vidtv_bridge.c
> @@ -548,7 +548,14 @@ static void vidtv_bridge_remove(struct platform_device *pdev)
>  	media_device_cleanup(&dvb->mdev);
>  #endif /* CONFIG_MEDIA_CONTROLLER_DVB */
>  
> -	mutex_destroy(&dvb->feed_lock);
> +	mutex_lock(&dvb->feed_lock);
> +	if (dvb->streaming) {
> +		dvb->streaming = false;
> +		vidtv_mux_stop_thread(dvb->mux);
> +		vidtv_mux_destroy(dvb->mux);
> +		dvb->mux = NULL;
> +	}
> +	mutex_unlock(&dvb->feed_lock);
>  
>  	for (i = 0; i < NUM_FE; ++i) {
>  		dvb_unregister_frontend(dvb->fe[i]);
> @@ -559,6 +566,9 @@ static void vidtv_bridge_remove(struct platform_device *pdev)
>  	dvb_dmxdev_release(&dvb->dmx_dev);
>  	dvb_dmx_release(&dvb->demux);
>  	dvb_unregister_adapter(&dvb->adapter);
> +
> +	mutex_destroy(&dvb->feed_lock);
> +
>  	dev_info(&pdev->dev, "Successfully removed vidtv\n");
>  }
>  
> -- 
> 2.43.0
>

Re: [PATCH] media: vidtv: fix mutex use-after-destroy in vidtv_bridge_remove()

[syzbot]

> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

This crash does not have a reproducer. I cannot test it.

>
>
> mutex_destroy(&dvb->feed_lock) is called too early in
> vidtv_bridge_remove(), before dvb_dmxdev_release() and
> dvb_dmx_release(). Both of these can still trigger vidtv_stop_feed(),
> which locks feed_lock, causing DEBUG_LOCKS_WARN_ON(lock->magic !=
> lock) in __mutex_lock().
>
> Fix by moving mutex_destroy() to after dvb_dmxdev_release() and
> dvb_dmx_release() return, and by stopping any active streaming under
> feed_lock beforehand so a late vidtv_stop_feed() call sees
> dvb->streaming == false and returns early.
>
> Reported-by: syzbot+3157015c6bd85395cddc@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=3157015c6bd85395cddc
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
>  drivers/media/test-drivers/vidtv/vidtv_bridge.c | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/media/test-drivers/vidtv/vidtv_bridge.c b/drivers/media/test-drivers/vidtv/vidtv_bridge.c
> index fd69b4ee16f4..6bebf4617100 100644
> --- a/drivers/media/test-drivers/vidtv/vidtv_bridge.c
> +++ b/drivers/media/test-drivers/vidtv/vidtv_bridge.c
> @@ -548,7 +548,14 @@ static void vidtv_bridge_remove(struct platform_device *pdev)
>  	media_device_cleanup(&dvb->mdev);
>  #endif /* CONFIG_MEDIA_CONTROLLER_DVB */
>  
> -	mutex_destroy(&dvb->feed_lock);
> +	mutex_lock(&dvb->feed_lock);
> +	if (dvb->streaming) {
> +		dvb->streaming = false;
> +		vidtv_mux_stop_thread(dvb->mux);
> +		vidtv_mux_destroy(dvb->mux);
> +		dvb->mux = NULL;
> +	}
> +	mutex_unlock(&dvb->feed_lock);
>  
>  	for (i = 0; i < NUM_FE; ++i) {
>  		dvb_unregister_frontend(dvb->fe[i]);
> @@ -559,6 +566,9 @@ static void vidtv_bridge_remove(struct platform_device *pdev)
>  	dvb_dmxdev_release(&dvb->dmx_dev);
>  	dvb_dmx_release(&dvb->demux);
>  	dvb_unregister_adapter(&dvb->adapter);
> +
> +	mutex_destroy(&dvb->feed_lock);
> +
>  	dev_info(&pdev->dev, "Successfully removed vidtv\n");
>  }
>  
> -- 
> 2.43.0
>