[PATCH] media: usbtv: fix use-after-free and lockdep panic on unbind

[PATCH] media: usbtv: fix use-after-free and lockdep panic on unbind

[Svyatoslav Nikolenko]

When a usbtv device is unplugged or unbound, a lockdep panic and
use-after-free occurs in the driver core.

The sequence of events leading to the crash is:
1. device_release_driver_internal() acquires dev->mutex.
2. usbtv_disconnect() is called, which in turn calls usbtv_video_free().
3. usbtv_video_free() prematurely calls v4l2_device_disconnect() and
   v4l2_device_put().
4. This drops the final reference on the parent USB device (intf->dev),
   triggering synchronous device deletion while the USB core is still
   holding dev->mutex.
5. When the core attempts to unlock dev->mutex, it operates on freed
   memory, causing a lockdep panic.

Furthermore, usbtv_disconnect() continues to access usbtv->udev after
usbtv_video_free() returns, leading to a direct use-after-free.

Fix this by removing the manual v4l2_device_disconnect() and
v4l2_device_put() calls from usbtv_video_free(). This allows
usbtv_video_free() to safely unregister the video node without destroying
the underlying structures. The final v4l2_device_put() at the end of
usbtv_disconnect() will now correctly trigger usbtv_release()
asynchronously, safely dropping the parent device reference only after all
system locks are released.

As a result of this cleanup, the dummy v4l2_device_get() previously used
to prevent premature deletion in the usbtv_probe() error path is no longer
needed and has been removed.

Fixes: a3550ea665ac ("[media] usbtv: split core and video implementation")
Reported-by: syzbot+ed3ed4f52d1fb6a7367d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ed3ed4f52d1fb6a7367d
Tested-by: syzbot+ed3ed4f52d1fb6a7367d@syzkaller.appspotmail.com
Signed-off-by: Svyatoslav Nikolenko <nsvatoslav515@gmail.com>
---
 drivers/media/usb/usbtv/usbtv-core.c  | 3 ---
 drivers/media/usb/usbtv/usbtv-video.c | 3 ---
 2 files changed, 6 deletions(-)

diff --git a/drivers/media/usb/usbtv/usbtv-core.c b/drivers/media/usb/usbtv/usbtv-core.c
index 4f10f6613bc4..8a68bc0aa884 100644
--- a/drivers/media/usb/usbtv/usbtv-core.c
+++ b/drivers/media/usb/usbtv/usbtv-core.c
@@ -112,9 +112,6 @@ static int usbtv_probe(struct usb_interface *intf,
 	return 0;
 
 usbtv_audio_fail:
-	/* we must not free at this point */
-	v4l2_device_get(&usbtv->v4l2_dev);
-	/* this will undo the v4l2_device_get() */
 	usbtv_video_free(usbtv);
 
 usbtv_video_fail:
diff --git a/drivers/media/usb/usbtv/usbtv-video.c b/drivers/media/usb/usbtv/usbtv-video.c
index 92bc7a2509c3..9e02038c3ff7 100644
--- a/drivers/media/usb/usbtv/usbtv-video.c
+++ b/drivers/media/usb/usbtv/usbtv-video.c
@@ -964,7 +964,4 @@ int usbtv_video_init(struct usbtv *usbtv)
 void usbtv_video_free(struct usbtv *usbtv)
 {
 	vb2_video_unregister_device(&usbtv->vdev);
-	v4l2_device_disconnect(&usbtv->v4l2_dev);
-
-	v4l2_device_put(&usbtv->v4l2_dev);
 }
-- 
2.47.3

Re: [PATCH] media: usbtv: fix use-after-free and lockdep panic on unbind

[hverkuil+cisco]

On 27/09/2026 20:07, Svyatoslav Nikolenko wrote:
> When a usbtv device is unplugged or unbound, a lockdep panic and
> use-after-free occurs in the driver core.
> 
> The sequence of events leading to the crash is:
> 1. device_release_driver_internal() acquires dev->mutex.
> 2. usbtv_disconnect() is called, which in turn calls usbtv_video_free().
> 3. usbtv_video_free() prematurely calls v4l2_device_disconnect() and
>    v4l2_device_put().
> 4. This drops the final reference on the parent USB device (intf->dev),
>    triggering synchronous device deletion while the USB core is still
>    holding dev->mutex.
> 5. When the core attempts to unlock dev->mutex, it operates on freed
>    memory, causing a lockdep panic.
> 
> Furthermore, usbtv_disconnect() continues to access usbtv->udev after
> usbtv_video_free() returns, leading to a direct use-after-free.
> 
> Fix this by removing the manual v4l2_device_disconnect() and
> v4l2_device_put() calls from usbtv_video_free(). This allows
> usbtv_video_free() to safely unregister the video node without destroying
> the underlying structures. The final v4l2_device_put() at the end of
> usbtv_disconnect() will now correctly trigger usbtv_release()
> asynchronously, safely dropping the parent device reference only after all
> system locks are released.
> 
> As a result of this cleanup, the dummy v4l2_device_get() previously used
> to prevent premature deletion in the usbtv_probe() error path is no longer
> needed and has been removed.
> 
> Fixes: a3550ea665ac ("[media] usbtv: split core and video implementation")
> Reported-by: syzbot+ed3ed4f52d1fb6a7367d@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=ed3ed4f52d1fb6a7367d
> Tested-by: syzbot+ed3ed4f52d1fb6a7367d@syzkaller.appspotmail.com
> Signed-off-by: Svyatoslav Nikolenko <nsvatoslav515@gmail.com>

Can you rebase on top of https://gitlab.freedesktop.org/linux-media/media-committers, 'next'
branch?

I wonder if the previous patch cb705f75d03e ("media: usbtv: fix null-pointer
dereference on disconnect") didn't already fix this.

Regards,

	Hans

> ---
>  drivers/media/usb/usbtv/usbtv-core.c  | 3 ---
>  drivers/media/usb/usbtv/usbtv-video.c | 3 ---
>  2 files changed, 6 deletions(-)
> 
> diff --git a/drivers/media/usb/usbtv/usbtv-core.c b/drivers/media/usb/usbtv/usbtv-core.c
> index 4f10f6613bc4..8a68bc0aa884 100644
> --- a/drivers/media/usb/usbtv/usbtv-core.c
> +++ b/drivers/media/usb/usbtv/usbtv-core.c
> @@ -112,9 +112,6 @@ static int usbtv_probe(struct usb_interface *intf,
>  	return 0;
>  
>  usbtv_audio_fail:
> -	/* we must not free at this point */
> -	v4l2_device_get(&usbtv->v4l2_dev);
> -	/* this will undo the v4l2_device_get() */
>  	usbtv_video_free(usbtv);
>  
>  usbtv_video_fail:
> diff --git a/drivers/media/usb/usbtv/usbtv-video.c b/drivers/media/usb/usbtv/usbtv-video.c
> index 92bc7a2509c3..9e02038c3ff7 100644
> --- a/drivers/media/usb/usbtv/usbtv-video.c
> +++ b/drivers/media/usb/usbtv/usbtv-video.c
> @@ -964,7 +964,4 @@ int usbtv_video_init(struct usbtv *usbtv)
>  void usbtv_video_free(struct usbtv *usbtv)
>  {
>  	vb2_video_unregister_device(&usbtv->vdev);
> -	v4l2_device_disconnect(&usbtv->v4l2_dev);
> -
> -	v4l2_device_put(&usbtv->v4l2_dev);
>  }