dvb_usbv2_init() powers the device on before registering the I2C adapter
and DVB resources, but it ignores failures from the power control
callback.
For CE6230, the power control callback selects interface 1 alternate
setting 1 with usb_set_interface(). A malformed device may not provide
that alternate setting, causing the initial power-on request to fail.
Probe nevertheless continues and may publish the I2C adapter before
failing later during adapter/frontend initialization.
The later failure path then synchronously unregisters the I2C adapter
while USB probe locks are still held. Userspace may already have opened
the newly published i2c-dev node, holding an adapter reference and making
i2c_del_adapter() wait indefinitely in the probe path.
Abort initialization as soon as the initial power-on step fails. This
keeps malformed devices from exposing partially initialized I2C/DVB
resources.
Fixes: c79b339f9292 ("[media] dvb_usb_v2: copy current dvb_usb as a starting point")
Cc: stable@vger.kernel.org
Reported-by: syzbot+f3f24bbe63f3f6db9f44@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/683a9833.a70a0220.1a6ae.000a.GAE@google.com/
Tested-by: syzbot+f3f24bbe63f3f6db9f44@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=f3f24bbe63f3f6db9f44
Signed-off-by: Xu Rao <raoxu@uniontech.com>
---
drivers/media/usb/dvb-usb-v2/dvb_usb_core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c b/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
index bd86d250433d..5635394e5b7d 100644
--- a/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
+++ b/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
@@ -852,7 +852,9 @@ static int dvb_usbv2_init(struct dvb_usb_device *d)
int ret;
dev_dbg(&d->udev->dev, "%s:\n", __func__);
- dvb_usbv2_device_power_ctrl(d, 1);
+ ret = dvb_usbv2_device_power_ctrl(d, 1);
+ if (ret < 0)
+ goto err;
if (d->props->read_config) {
ret = d->props->read_config(d);
--
2.43.0