For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] media: vidtv: fix memory leak by cleaning up mux in bridge_remove
Author: zhanghaotian@uniontech.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

The vidtv driver relies on stop_feed being called via the dmxdev file
close path to trigger vidtv_stop_streaming() which destroys the mux.
However, if the DVB core close path does not reach stop_filtering
(e.g. due to race conditions), the entire mux and all channel
descriptors are permanently leaked.

Fix this by proactively stopping streaming and destroying the mux in
vidtv_bridge_remove(), before releasing the dmxdev and dmx resources.
Use the existing feed_lock mutex to synchronize with any concurrent
stop_feed callback.  After cleaning up the mux, set dvb->streaming to
false and dvb->mux to NULL so any subsequent stop_feed will return
early safely.

Also fix a pre-existing bug where mutex_destroy(&dvb->feed_lock) was
called before dvb_dmxdev_release(), which could cause vidtv_stop_feed
to operate on a destroyed mutex if the fd close path races with module
removal.

Reported-by: syzbot+acc3b75c010446ad403f@syzkaller.appspotmail.com
Signed-off-by: zhanghaotian <zhanghaotian@uniontech.com>
---
 drivers/media/test-drivers/vidtv/vidtv_bridge.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/media/test-drivers/vidtv/vidtv_bridge.c b/drivers/media/test-drivers/vidtv/vidtv_bridge.c
index a8a76434989c..3ea8cc04571d 100644
--- a/drivers/media/test-drivers/vidtv/vidtv_bridge.c
+++ b/drivers/media/test-drivers/vidtv/vidtv_bridge.c
@@ -548,7 +548,13 @@ static void vidtv_bridge_remove(struct platform_device *pdev)
 	media_device_cleanup(&dvb->mdev);
 #endif /* CONFIG_MEDIA_CONTROLLER_DVB */
 
-	mutex_destroy(&dvb->feed_lock);
+	mutex_lock(&dvb->feed_lock);
+	if (dvb->streaming) {
+		dvb->streaming = false;
+		vidtv_mux_destroy(dvb->mux);
+		dvb->mux = NULL;
+	}
+	mutex_unlock(&dvb->feed_lock);
 
 	for (i = 0; i < NUM_FE; ++i) {
 		dvb_unregister_frontend(dvb->fe[i]);
@@ -559,6 +565,8 @@ static void vidtv_bridge_remove(struct platform_device *pdev)
 	dvb_dmxdev_release(&dvb->dmx_dev);
 	dvb_dmx_release(&dvb->demux);
 	dvb_unregister_adapter(&dvb->adapter);
+
+	mutex_destroy(&dvb->feed_lock);
 	dev_info(&pdev->dev, "Successfully removed vidtv\n");
 }
 
-- 
2.30.2