[PATCH 1/2] media: redrat3: unregister the rc device when probe fails

[PATCH 1/2] media: redrat3: unregister the rc device when probe fails

[Nguyen Ngoc Thang]

redrat3_dev_probe() registers the rc device, whose input device points
its name and phys at strings embedded in struct redrat3_dev, and only
then calls redrat3_enable_detector(). If that fails, the error path
frees rr3 but leaves the rc device registered and leaks it. Reading its
"uevent" attribute afterwards dereferences the freed name/phys:

  BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0
  Read of size 1 at addr ffff8880272bf758 by task repro/4968
   add_uevent_var+0x183/0x3a0
   input_dev_uevent+0x162/0x900
   dev_uevent+0x2f1/0x870
   uevent_show+0x1ca/0x3a0
   ...

Unregister and free the rc device on that path, mirroring
redrat3_dev_disconnect(): stop the URBs first, since their handlers use
the rc device, and only then unregister it.

Reproduced with a raw-gadget RedRat3 that reports detector status 0.

Fixes: 2154be651b90 ("[media] redrat3: new rc-core IR transceiver device driver")
Cc: stable@vger.kernel.org
Reported-by: syzbot+2a123f6269da57ffefaa@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2a123f6269da57ffefaa
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
---
 drivers/media/rc/redrat3.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
index 3f828a564e19..e9dd563e9cb3 100644
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -1111,13 +1111,19 @@ static int redrat3_dev_probe(struct usb_interface *intf,
 	/* might be all we need to do? */
 	retval = redrat3_enable_detector(rr3);
 	if (retval < 0)
-		goto led_free;
+		goto rc_unreg;
 
 	/* we can register the device now, as it is ready */
 	usb_set_intfdata(intf, rr3);
 
 	return 0;
 
+rc_unreg:
+	/* URB handlers use rc */
+	usb_kill_urb(rr3->narrow_urb);
+	usb_kill_urb(rr3->wide_urb);
+	rc_unregister_device(rr3->rc);
+	rc_free_device(rr3->rc);
 led_free:
 	led_classdev_unregister(&rr3->led);
 redrat_free:
-- 
2.43.0

Re: [PATCH 1/2] media: redrat3: unregister the rc device when probe fails

[Sean Young]

On Sat, Sep 26, 2026 at 12:07:11AM +0700, Nguyen Ngoc Thang wrote:
> redrat3_dev_probe() registers the rc device, whose input device points
> its name and phys at strings embedded in struct redrat3_dev, and only
> then calls redrat3_enable_detector(). If that fails, the error path
> frees rr3 but leaves the rc device registered and leaks it. Reading its
> "uevent" attribute afterwards dereferences the freed name/phys:
> 
>   BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0
>   Read of size 1 at addr ffff8880272bf758 by task repro/4968
>    add_uevent_var+0x183/0x3a0
>    input_dev_uevent+0x162/0x900
>    dev_uevent+0x2f1/0x870
>    uevent_show+0x1ca/0x3a0
>    ...
> 
> Unregister and free the rc device on that path, mirroring
> redrat3_dev_disconnect(): stop the URBs first, since their handlers use
> the rc device, and only then unregister it.

This is already fixed in:

https://gitlab.freedesktop.org/linux-media/media-committers/-/commit/af452b9e01331b5338a1e5141624f17607239207?anubis_answer=mango

Thank you for reporting and writing a patch, it's appreciated.

Sean

> 
> Reproduced with a raw-gadget RedRat3 that reports detector status 0.
> 
> Fixes: 2154be651b90 ("[media] redrat3: new rc-core IR transceiver device driver")
> Cc: stable@vger.kernel.org
> Reported-by: syzbot+2a123f6269da57ffefaa@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=2a123f6269da57ffefaa
> Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
> ---
>  drivers/media/rc/redrat3.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
> index 3f828a564e19..e9dd563e9cb3 100644
> --- a/drivers/media/rc/redrat3.c
> +++ b/drivers/media/rc/redrat3.c
> @@ -1111,13 +1111,19 @@ static int redrat3_dev_probe(struct usb_interface *intf,
>  	/* might be all we need to do? */
>  	retval = redrat3_enable_detector(rr3);
>  	if (retval < 0)
> -		goto led_free;
> +		goto rc_unreg;
>  
>  	/* we can register the device now, as it is ready */
>  	usb_set_intfdata(intf, rr3);
>  
>  	return 0;
>  
> +rc_unreg:
> +	/* URB handlers use rc */
> +	usb_kill_urb(rr3->narrow_urb);
> +	usb_kill_urb(rr3->wide_urb);
> +	rc_unregister_device(rr3->rc);
> +	rc_free_device(rr3->rc);
>  led_free:
>  	led_classdev_unregister(&rr3->led);
>  redrat_free:
> -- 
> 2.43.0
>