media: usbvision: Fix invalid accesses after device disconnect

The syzbot fuzzer found two invalid-access bugs in the usbvision
driver.  These bugs occur when userspace keeps the device file open
after the device has been disconnected and usbvision_disconnect() has
set usbvision->dev to NULL:

	When the device file is closed, usbvision_radio_close() tries
	to issue a usb_set_interface() call, passing the NULL pointer
	as its first argument.

	If userspace performs a querycap ioctl call, vidioc_querycap()
	calls usb_make_path() with the same NULL pointer.

This patch fixes the problems by making the appropriate tests
beforehand.  Note that vidioc_querycap() is protected by
usbvision->v4l2_lock, acquired in a higher layer of the V4L2
subsystem.

Reported-and-tested-by: syzbot+7fa38a608b1075dfd634@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c
index cdc66adda75584d1f0eb314ac764c0018d1ea043..62dec73aec6ef2ab272d9b2e19197cf7e15e94b0 100644 (file)
--- a/drivers/media/usb/usbvision/usbvision-video.c
+++ b/drivers/media/usb/usbvision/usbvision-video.c
@@ -453,6 +453,9 @@ static int vidioc_querycap(struct file *file, void  *priv,
 {
        struct usb_usbvision *usbvision = video_drvdata(file);
 
+       if (!usbvision->dev)
+               return -ENODEV;
+
        strscpy(vc->driver, "USBVision", sizeof(vc->driver));
        strscpy(vc->card,
                usbvision_device_data[usbvision->dev_model].model_string,
@@ -1099,8 +1102,9 @@ static int usbvision_radio_close(struct file *file)
        mutex_lock(&usbvision->v4l2_lock);
        /* Set packet size to 0 */
        usbvision->iface_alt = 0;
-       usb_set_interface(usbvision->dev, usbvision->iface,
-                                   usbvision->iface_alt);
+       if (usbvision->dev)
+               usb_set_interface(usbvision->dev, usbvision->iface,
+                                 usbvision->iface_alt);
 
        usbvision_audio_off(usbvision);
        usbvision->radio = 0;