Re: [PATCH] media: usbtv: fix use-after-free and lockdep panic on unbind

[hverkuil+cisco@kernel.org]

On 27/09/2026 20:07, Svyatoslav Nikolenko wrote:
> When a usbtv device is unplugged or unbound, a lockdep panic and
> use-after-free occurs in the driver core.
> 
> The sequence of events leading to the crash is:
> 1. device_release_driver_internal() acquires dev->mutex.
> 2. usbtv_disconnect() is called, which in turn calls usbtv_video_free().
> 3. usbtv_video_free() prematurely calls v4l2_device_disconnect() and
>    v4l2_device_put().
> 4. This drops the final reference on the parent USB device (intf->dev),
>    triggering synchronous device deletion while the USB core is still
>    holding dev->mutex.
> 5. When the core attempts to unlock dev->mutex, it operates on freed
>    memory, causing a lockdep panic.
> 
> Furthermore, usbtv_disconnect() continues to access usbtv->udev after
> usbtv_video_free() returns, leading to a direct use-after-free.
> 
> Fix this by removing the manual v4l2_device_disconnect() and
> v4l2_device_put() calls from usbtv_video_free(). This allows
> usbtv_video_free() to safely unregister the video node without destroying
> the underlying structures. The final v4l2_device_put() at the end of
> usbtv_disconnect() will now correctly trigger usbtv_release()
> asynchronously, safely dropping the parent device reference only after all
> system locks are released.
> 
> As a result of this cleanup, the dummy v4l2_device_get() previously used
> to prevent premature deletion in the usbtv_probe() error path is no longer
> needed and has been removed.
> 
> Fixes: a3550ea665ac ("[media] usbtv: split core and video implementation")
> Reported-by: syzbot+ed3ed4f52d1fb6a7367d@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=ed3ed4f52d1fb6a7367d
> Tested-by: syzbot+ed3ed4f52d1fb6a7367d@syzkaller.appspotmail.com
> Signed-off-by: Svyatoslav Nikolenko <nsvatoslav515@gmail.com>

Can you rebase on top of https://gitlab.freedesktop.org/linux-media/media-committers, 'next'
branch?

I wonder if the previous patch cb705f75d03e ("media: usbtv: fix null-pointer
dereference on disconnect") didn't already fix this.

Regards,

	Hans

> ---
>  drivers/media/usb/usbtv/usbtv-core.c  | 3 ---
>  drivers/media/usb/usbtv/usbtv-video.c | 3 ---
>  2 files changed, 6 deletions(-)
> 
> diff --git a/drivers/media/usb/usbtv/usbtv-core.c b/drivers/media/usb/usbtv/usbtv-core.c
> index 4f10f6613bc4..8a68bc0aa884 100644
> --- a/drivers/media/usb/usbtv/usbtv-core.c
> +++ b/drivers/media/usb/usbtv/usbtv-core.c
> @@ -112,9 +112,6 @@ static int usbtv_probe(struct usb_interface *intf,
>  	return 0;
>  
>  usbtv_audio_fail:
> -	/* we must not free at this point */
> -	v4l2_device_get(&usbtv->v4l2_dev);
> -	/* this will undo the v4l2_device_get() */
>  	usbtv_video_free(usbtv);
>  
>  usbtv_video_fail:
> diff --git a/drivers/media/usb/usbtv/usbtv-video.c b/drivers/media/usb/usbtv/usbtv-video.c
> index 92bc7a2509c3..9e02038c3ff7 100644
> --- a/drivers/media/usb/usbtv/usbtv-video.c
> +++ b/drivers/media/usb/usbtv/usbtv-video.c
> @@ -964,7 +964,4 @@ int usbtv_video_init(struct usbtv *usbtv)
>  void usbtv_video_free(struct usbtv *usbtv)
>  {
>  	vb2_video_unregister_device(&usbtv->vdev);
> -	v4l2_device_disconnect(&usbtv->v4l2_dev);
> -
> -	v4l2_device_put(&usbtv->v4l2_dev);
>  }