From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ABBB2C6FA83 for ; Mon, 26 Sep 2022 10:26:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235355AbiIZK0o (ORCPT ); Mon, 26 Sep 2022 06:26:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59020 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235440AbiIZKXt (ORCPT ); Mon, 26 Sep 2022 06:23:49 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 849D9DEDD; Mon, 26 Sep 2022 03:17:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id CE33ACE10E9; Mon, 26 Sep 2022 10:16:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A9F7AC433D6; Mon, 26 Sep 2022 10:16:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1664187411; bh=LjL2pJ7jfJN9nliWkDI+Wueh5f4fUGrGKlyxUIDa3ZE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bWru3uGTZtmIoPBfWBfQ//UB6zUJxezVdjNMwst+DmHX72t1xa2uFUXKdUMSkDhQW Pl97O1MIkx6RK25cb8VekikRpDCmqDBJ2K1ZJxYmUyQUfPf8c6fZKkQWOyBs+5N0Vp 7DrpWbk+bPnO+YGNJCJbGoP1NUl+A8PZcDoP152Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzkaller , Dongliang Mu , Hans Verkuil , Dragos-Marian Panait Subject: [PATCH 4.14 40/40] media: em28xx: initialize refcount before kref_get Date: Mon, 26 Sep 2022 12:12:08 +0200 Message-Id: <20220926100739.866179955@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220926100738.148626940@linuxfoundation.org> References: <20220926100738.148626940@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Dongliang Mu commit c08eadca1bdfa099e20a32f8fa4b52b2f672236d upstream. The commit 47677e51e2a4("[media] em28xx: Only deallocate struct em28xx after finishing all extensions") adds kref_get to many init functions (e.g., em28xx_audio_init). However, kref_init is called too late in em28xx_usb_probe, since em28xx_init_dev before will invoke those init functions and call kref_get function. Then refcount bug occurs in my local syzkaller instance. Fix it by moving kref_init before em28xx_init_dev. This issue occurs not only in dev but also dev->dev_next. Fixes: 47677e51e2a4 ("[media] em28xx: Only deallocate struct em28xx after finishing all extensions") Reported-by: syzkaller Signed-off-by: Dongliang Mu Signed-off-by: Hans Verkuil [DP: drop changes related to dev->dev_next as second tuner functionality was added in 4.16] Signed-off-by: Dragos-Marian Panait Signed-off-by: Greg Kroah-Hartman --- drivers/media/usb/em28xx/em28xx-cards.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/media/usb/em28xx/em28xx-cards.c +++ b/drivers/media/usb/em28xx/em28xx-cards.c @@ -3644,6 +3644,8 @@ static int em28xx_usb_probe(struct usb_i goto err_free; } + kref_init(&dev->ref); + dev->devno = nr; dev->model = id->driver_info; dev->alt = -1; @@ -3730,8 +3732,6 @@ static int em28xx_usb_probe(struct usb_i dev->dvb_xfer_bulk ? "bulk" : "isoc"); } - kref_init(&dev->ref); - request_modules(dev); /*