Re: [syzbot] [media?] [usb?] KASAN: slab-use-after-free Read in v4l2_open
From: Edward Adam Davis
Date: Thu Mar 19 2026 - 05:01:20 EST
#syz test
diff --git a/drivers/media/v4l2-core/v4l2-dev.c b/drivers/media/v4l2-core/v4l2-dev.c
index 6ce623a1245a..0639315f9611 100644
--- a/drivers/media/v4l2-core/v4l2-dev.c
+++ b/drivers/media/v4l2-core/v4l2-dev.c
@@ -423,7 +423,6 @@ static int v4l2_open(struct inode *inode, struct file *filp)
}
/* and increase the device refcount */
video_get(vdev);
- mutex_unlock(&videodev_lock);
if (!video_is_registered(vdev)) {
ret = -ENODEV;
@@ -448,6 +447,7 @@ static int v4l2_open(struct inode *inode, struct file *filp)
/* decrease the refcount in case of an error */
if (ret)
video_put(vdev);
+ mutex_unlock(&videodev_lock);
return ret;
}