Message-ID: <sashiko-outbox-192175@kernel.org>
From: sashiko-bot@kernel.org
Subject: Re: [PATCH v2] media: em28xx: fix v4l2 use-after-free after failed
 init
Reply-To: sashiko-reviews@lists.linux.dev
To: "Drif Abdelmalek Mohamed Said" <drifabdelmalekmohamedsaid@gmail.com>
Cc: linux-usb@vger.kernel.org
In-Reply-To: <20261031210922.323-1-drifabdelmalekmohamedsaid@gmail.com>
References: <20261031210922.323-1-drifabdelmalekmohamedsaid@gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Date: Sat, 31 Oct 2026 21:25:59 +0000
Precedence: list

> em28xx_v4l2_init() publishes the new object in dev->v4l2 before the
> video device is registered. If a later initialization step fails -past
> v4l2_device_register-,  the error path unregisters the device nodes and
> drops the initial v4l2_device reference, but previously left dev->v4l2
> pointing at the freed object.
>=20
> syzbot reported:
>=20
> BUG: KASAN: slab-use-after-free in v4l2_device_disconnect+0xa4/0xc0
> 		drivers/media/v4l2-core/v4l2-device.c:78
>=20
> em28xx_v4l2_fini() is called later from USB disconnect. It reads
> dev->v4l2 before taking dev->lock, and on the failed-init path it owns
> no reference. The last close of the video node can therefore drop the
> final v4l2_device reference and free the object between that read and
> its use in v4l2_device_disconnect(), causing a use-after-free.
>=20
> Fixing this by clearing dev->v4l2 under dev->lock in the init error path
> before dropping the initial reference, and read it under dev->lock in fin=
i.
> This makes fini see NULL after a failed init, while the successful path
> continues to hold the initial reference until fini is done.
>=20
> Fixes: 288254383674 ("media: em28xx: use v4l2_device release callback")
> Reported-by: syzbot+1e71765881a6fc43185f@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=3D1e71765881a6fc43185f
> Cc: stable@vger.kernel.org
> Signed-off-by: Drif Abdelmalek Mohamed Said <drifabdelmalekmohamedsaid@gm=
ail.com>

Sashiko has reviewed this patch and found no issues.

--=20
Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20261031210922.323-=
1-drifabdelmalekmohamedsaid@gmail.com?part=3D1