[PATCH v1 0/2] Input: sur40 - fix UAF/hang on closing the video node after unplug

[Nguyen Ngoc Thang]

Hi,

syzbot reported a slab-use-after-free in vb2_core_queue_release() [1]:
closing /dev/v4l-touch* after the SUR40 was unplugged reads freed memory.

Cause: sur40_disconnect() kfree()s struct sur40_state, which embeds the
video_device, v4l2_device and vb2_queue, even though a video node can
still be open. v4l2_release() and vb2_fop_release() then dereference
freed memory. Patch 2 fixes this by giving the v4l2_device a release()
callback that frees the state, and dropping the disconnect path's
reference with v4l2_device_put(), so the last close does the freeing.
The probe error paths never expose the node and still free directly.

Patch 1 is needed first: once the state outlives disconnect, closing a
node that is still streaming hangs forever, because
sur40_stop_streaming() waits (vb2_wait_for_all_buffers) for buffers
that only the input poll callback completes, and that is gone after
unplug. Returning the queued buffers before the wait fixes it. This was
masked by the UAF above.

Testing: no hardware, so I emulated a SUR40 (045e:0775) with raw-gadget
on dummy_hcd in QEMU with KASAN. The reproducer enumerates the device,
starts a non-blocking read() on the video node (making the fd the queue
owner), disconnects the gadget, then close()s the fd.
  - before: KASAN: slab-use-after-free in v4l2_release(), allocated in
    sur40_probe(), freed in sur40_disconnect() (same alloc/free stacks
    as the syzbot report)
  - patch 1 only: no KASAN, but close() blocks in
    vb2_wait_for_all_buffers()  [only meaningful with patch 2 applied]
  - both patches: 5 consecutive enumerate/disconnect/close cycles, no
    KASAN, no hang.
(The dma_map_sg WARNING during read() in the log comes from dummy_hcd
having no DMA mask; it is unrelated.)

Nguyen Ngoc Thang (2):
  Input: sur40 - don't wait for buffers nothing will complete
  Input: sur40 - keep device state alive until the video node is
    released

 drivers/input/touchscreen/sur40.c | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

-- 
2.43.0