Re: [syzbot] [media?] [usb?] KASAN: slab-use-after-free Read in v4l2_release (2)

[Hillf Danton <hdanton@sina.com>]

> Date: Sat, 23 Aug 2025 23:17:26 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    8d245acc1e88 Merge tag 'char-misc-6.17-rc3' of git://git.k..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=15f37062580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=292f3bc9f654adeb
> dashboard link: https://syzkaller.appspot.com/bug?extid=a658d41cf8564471775e
> compiler:       Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14c267bc580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=13a8c862580000

#syz test

--- x/drivers/media/usb/hackrf/hackrf.c
+++ y/drivers/media/usb/hackrf/hackrf.c
@@ -1345,7 +1345,7 @@ static int hackrf_probe(struct usb_inter
 		const struct usb_device_id *id)
 {
 	struct hackrf_dev *dev;
-	int ret;
+	int ret, registered = 0;
 	u8 u8tmp, buf[BUF_SIZE];
 
 	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
@@ -1487,6 +1487,7 @@ static int hackrf_probe(struct usb_inter
 			"Failed to register as video device (%d)\n", ret);
 		goto err_v4l2_device_unregister;
 	}
+	registered++;
 	dev_info(dev->dev, "Registered as %s\n",
 		 video_device_node_name(&dev->rx_vdev));
 
@@ -1520,7 +1521,8 @@ err_v4l2_ctrl_handler_free_tx:
 err_v4l2_ctrl_handler_free_rx:
 	v4l2_ctrl_handler_free(&dev->rx_ctrl_handler);
 err_kfree:
-	kfree(dev);
+	if (!registered)
+		kfree(dev);
 err:
 	dev_dbg(&intf->dev, "failed=%d\n", ret);
 	return ret;
--