media: em28xx: add missing em28xx_close_extension

[ Upstream commit 2c98b8a3458df03abdc6945bbef67ef91d181938 ]

If em28xx dev has ->dev_next pointer, we need to delete ->dev_next list
node from em28xx_extension_devlist on disconnect to avoid UAF bugs and
corrupted list bugs, since driver frees this pointer on disconnect.

Reported-and-tested-by: syzbot+a6969ef522a36d3344c9@syzkaller.appspotmail.com
Fixes: 1a23f81b7dc3 ("V4L/DVB (9979): em28xx: move usb probe code to a proper place")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
index 3f59a98dbf9a161e10dec9e37e5d204e83c9363a..ec608f60d2c752b929a028a58adcd73e7a89725e 100644 (file)
--- a/drivers/media/usb/em28xx/em28xx-cards.c
+++ b/drivers/media/usb/em28xx/em28xx-cards.c
@@ -4030,8 +4030,11 @@ static void em28xx_usb_disconnect(struct usb_interface *intf)
 
        em28xx_close_extension(dev);
 
-       if (dev->dev_next)
+       if (dev->dev_next) {
+               em28xx_close_extension(dev->dev_next);
                em28xx_release_resources(dev->dev_next);
+       }
+
        em28xx_release_resources(dev);
 
        if (dev->dev_next) {