[PATCH] media: rc: redrat3: fix use-after-free of input device name/phys strings

[PATCH] media: rc: redrat3: fix use-after-free of input device name/phys strings

[Joas Antonio dos Santos via B4 Relay]

From: Joas Antonio dos Santos <joasantonio108@gmail.com>

redrat3_init_rc_dev() sets rc->device_name and rc->input_phys to point
at the name[] and phys[] arrays embedded in struct redrat3_dev.
rc_prepare_rx_device() then copies these pointers into input_dev->name
and input_dev->phys without duplicating the strings.

When redrat3_dev_disconnect() runs, it calls redrat3_delete() which
kfrees the redrat3_dev struct, freeing the embedded name and phys
arrays.  If an evdev client still holds the input device open, a
subsequent EVIOCGNAME or EVIOCGPHYS ioctl calls str_to_user() which
reads the freed string via strlen(), triggering a KASAN
slab-use-after-free on the freed kmalloc-2k object.

Fix by allocating the name and phys strings with devm_kasprintf() and
devm_kzalloc() respectively, tied to the USB interface device lifetime.
This ensures the strings outlive the input device, since the USB
interface device (and its devres) is not released until all references
to it are dropped.

Found by LLM-assisted code review of syzbot-reported crash patterns.

Reported-by: syzbot+aec1962419768c5caf88@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=aec1962419768c5caf88
Fixes: 2154be651bfd ("[media] redrat3: new driver")
Cc: stable@vger.kernel.org
Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>
---
redrat3_init_rc_dev() stores pointers to the name[] and phys[] arrays
embedded in struct redrat3_dev into rc->device_name and rc->input_phys.
These are copied into input_dev->name/phys without duplication.

When the device disconnects, kfree(rr3) frees the strings while evdev
may still hold the input device open.  A subsequent EVIOCGNAME ioctl
dereferences the freed string via str_to_user() -> strlen(), triggering
a KASAN slab-use-after-free.

syzbot link: https://syzkaller.appspot.com/bug?extid=aec1962419768c5caf88
---
 drivers/media/rc/redrat3.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
index 3e82b5e66..d9e37ede2 100644
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -229,8 +229,8 @@ struct redrat3_dev {
 
 	u32 carrier;
 
-	char name[64];
-	char phys[64];
+	char *name;
+	char *phys;
 };
 
 static void redrat3_dump_fw_error(struct redrat3_dev *rr3, int code)
@@ -943,11 +943,16 @@ static struct rc_dev *redrat3_init_rc_dev(struct redrat3_dev *rr3)
 	if (!rc)
 		return NULL;
 
-	snprintf(rr3->name, sizeof(rr3->name),
-		 "RedRat3%s Infrared Remote Transceiver",
-		 prod == USB_RR3IIUSB_PRODUCT_ID ? "-II" : "");
+	rr3->name = devm_kasprintf(rr3->dev, GFP_KERNEL,
+				   "RedRat3%s Infrared Remote Transceiver",
+				   prod == USB_RR3IIUSB_PRODUCT_ID ? "-II" : "");
+	if (!rr3->name)
+		goto out;
 
-	usb_make_path(rr3->udev, rr3->phys, sizeof(rr3->phys));
+	rr3->phys = devm_kzalloc(rr3->dev, 64, GFP_KERNEL);
+	if (!rr3->phys)
+		goto out;
+	usb_make_path(rr3->udev, rr3->phys, 64);
 
 	rc->device_name = rr3->name;
 	rc->input_phys = rr3->phys;

---
base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d
change-id: 20261104-redrat3-input-uaf-b6d3789e63c9

Best regards,
-- 
Joas Antonio dos Santos <joasantonio108@gmail.com>

Re: [PATCH] media: rc: redrat3: fix use-after-free of input device name/phys strings

[Sean Young]

On Wed, Nov 04, 2026 at 09:03:01PM +0000, Joas Antonio dos Santos via B4 Relay wrote:
> From: Joas Antonio dos Santos <joasantonio108@gmail.com>
> 
> redrat3_init_rc_dev() sets rc->device_name and rc->input_phys to point
> at the name[] and phys[] arrays embedded in struct redrat3_dev.
> rc_prepare_rx_device() then copies these pointers into input_dev->name
> and input_dev->phys without duplicating the strings.
> 
> When redrat3_dev_disconnect() runs, it calls redrat3_delete() which
> kfrees the redrat3_dev struct, freeing the embedded name and phys
> arrays.  If an evdev client still holds the input device open, a
> subsequent EVIOCGNAME or EVIOCGPHYS ioctl calls str_to_user() which
> reads the freed string via strlen(), triggering a KASAN
> slab-use-after-free on the freed kmalloc-2k object.

This is nonsense. rc_unregister_device() calls input_unregister_device()
so EVIOCGNAME will not work any more.

My guess this syzbot issue is resolved by commit
af452b9e01331b5338a1e5141624f17607239207 and this is the error path in probe,
not disconnect..


Sean

> 
> Fix by allocating the name and phys strings with devm_kasprintf() and
> devm_kzalloc() respectively, tied to the USB interface device lifetime.
> This ensures the strings outlive the input device, since the USB
> interface device (and its devres) is not released until all references
> to it are dropped.
> 
> Found by LLM-assisted code review of syzbot-reported crash patterns.
> 
> Reported-by: syzbot+aec1962419768c5caf88@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=aec1962419768c5caf88
> Fixes: 2154be651bfd ("[media] redrat3: new driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>
> ---
> redrat3_init_rc_dev() stores pointers to the name[] and phys[] arrays
> embedded in struct redrat3_dev into rc->device_name and rc->input_phys.
> These are copied into input_dev->name/phys without duplication.
> 
> When the device disconnects, kfree(rr3) frees the strings while evdev
> may still hold the input device open.  A subsequent EVIOCGNAME ioctl
> dereferences the freed string via str_to_user() -> strlen(), triggering
> a KASAN slab-use-after-free.
> 
> syzbot link: https://syzkaller.appspot.com/bug?extid=aec1962419768c5caf88
> ---
>  drivers/media/rc/redrat3.c | 17 +++++++++++------
>  1 file changed, 11 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
> index 3e82b5e66..d9e37ede2 100644
> --- a/drivers/media/rc/redrat3.c
> +++ b/drivers/media/rc/redrat3.c
> @@ -229,8 +229,8 @@ struct redrat3_dev {
>  
>  	u32 carrier;
>  
> -	char name[64];
> -	char phys[64];
> +	char *name;
> +	char *phys;
>  };
>  
>  static void redrat3_dump_fw_error(struct redrat3_dev *rr3, int code)
> @@ -943,11 +943,16 @@ static struct rc_dev *redrat3_init_rc_dev(struct redrat3_dev *rr3)
>  	if (!rc)
>  		return NULL;
>  
> -	snprintf(rr3->name, sizeof(rr3->name),
> -		 "RedRat3%s Infrared Remote Transceiver",
> -		 prod == USB_RR3IIUSB_PRODUCT_ID ? "-II" : "");
> +	rr3->name = devm_kasprintf(rr3->dev, GFP_KERNEL,
> +				   "RedRat3%s Infrared Remote Transceiver",
> +				   prod == USB_RR3IIUSB_PRODUCT_ID ? "-II" : "");
> +	if (!rr3->name)
> +		goto out;
>  
> -	usb_make_path(rr3->udev, rr3->phys, sizeof(rr3->phys));
> +	rr3->phys = devm_kzalloc(rr3->dev, 64, GFP_KERNEL);
> +	if (!rr3->phys)
> +		goto out;
> +	usb_make_path(rr3->udev, rr3->phys, 64);
>  
>  	rc->device_name = rr3->name;
>  	rc->input_phys = rr3->phys;
> 
> ---
> base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d
> change-id: 20261104-redrat3-input-uaf-b6d3789e63c9
> 
> Best regards,
> -- 
> Joas Antonio dos Santos <joasantonio108@gmail.com>
> 
> 

Re: [PATCH] media: rc: redrat3: fix use-after-free of input device name/phys strings

[Joas Antonio]

Hi Sean,

You're right, I apologize for the incorrect analysis.

rc_unregister_device() calls input_unregister_device() before
redrat3_delete() frees the struct, so EVIOCGNAME cannot reach
the freed name/phys strings via the disconnect path.

Thank you for pointing to af452b9e01331b — I should have checked
the probe error path more carefully.

Regards,
Joas


Em dom., 8 de nov. de 2026 às 11:06, Sean Young <sean@mess.org> escreveu:
>
> On Wed, Nov 04, 2026 at 09:03:01PM +0000, Joas Antonio dos Santos via B4 Relay wrote:
> > From: Joas Antonio dos Santos <joasantonio108@gmail.com>
> >
> > redrat3_init_rc_dev() sets rc->device_name and rc->input_phys to point
> > at the name[] and phys[] arrays embedded in struct redrat3_dev.
> > rc_prepare_rx_device() then copies these pointers into input_dev->name
> > and input_dev->phys without duplicating the strings.
> >
> > When redrat3_dev_disconnect() runs, it calls redrat3_delete() which
> > kfrees the redrat3_dev struct, freeing the embedded name and phys
> > arrays.  If an evdev client still holds the input device open, a
> > subsequent EVIOCGNAME or EVIOCGPHYS ioctl calls str_to_user() which
> > reads the freed string via strlen(), triggering a KASAN
> > slab-use-after-free on the freed kmalloc-2k object.
>
> This is nonsense. rc_unregister_device() calls input_unregister_device()
> so EVIOCGNAME will not work any more.
>
> My guess this syzbot issue is resolved by commit
> af452b9e01331b5338a1e5141624f17607239207 and this is the error path in probe,
> not disconnect..
>
>
> Sean
>
> >
> > Fix by allocating the name and phys strings with devm_kasprintf() and
> > devm_kzalloc() respectively, tied to the USB interface device lifetime.
> > This ensures the strings outlive the input device, since the USB
> > interface device (and its devres) is not released until all references
> > to it are dropped.
> >
> > Found by LLM-assisted code review of syzbot-reported crash patterns.
> >
> > Reported-by: syzbot+aec1962419768c5caf88@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=aec1962419768c5caf88
> > Fixes: 2154be651bfd ("[media] redrat3: new driver")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>
> > ---
> > redrat3_init_rc_dev() stores pointers to the name[] and phys[] arrays
> > embedded in struct redrat3_dev into rc->device_name and rc->input_phys.
> > These are copied into input_dev->name/phys without duplication.
> >
> > When the device disconnects, kfree(rr3) frees the strings while evdev
> > may still hold the input device open.  A subsequent EVIOCGNAME ioctl
> > dereferences the freed string via str_to_user() -> strlen(), triggering
> > a KASAN slab-use-after-free.
> >
> > syzbot link: https://syzkaller.appspot.com/bug?extid=aec1962419768c5caf88
> > ---
> >  drivers/media/rc/redrat3.c | 17 +++++++++++------
> >  1 file changed, 11 insertions(+), 6 deletions(-)
> >
> > diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
> > index 3e82b5e66..d9e37ede2 100644
> > --- a/drivers/media/rc/redrat3.c
> > +++ b/drivers/media/rc/redrat3.c
> > @@ -229,8 +229,8 @@ struct redrat3_dev {
> >
> >       u32 carrier;
> >
> > -     char name[64];
> > -     char phys[64];
> > +     char *name;
> > +     char *phys;
> >  };
> >
> >  static void redrat3_dump_fw_error(struct redrat3_dev *rr3, int code)
> > @@ -943,11 +943,16 @@ static struct rc_dev *redrat3_init_rc_dev(struct redrat3_dev *rr3)
> >       if (!rc)
> >               return NULL;
> >
> > -     snprintf(rr3->name, sizeof(rr3->name),
> > -              "RedRat3%s Infrared Remote Transceiver",
> > -              prod == USB_RR3IIUSB_PRODUCT_ID ? "-II" : "");
> > +     rr3->name = devm_kasprintf(rr3->dev, GFP_KERNEL,
> > +                                "RedRat3%s Infrared Remote Transceiver",
> > +                                prod == USB_RR3IIUSB_PRODUCT_ID ? "-II" : "");
> > +     if (!rr3->name)
> > +             goto out;
> >
> > -     usb_make_path(rr3->udev, rr3->phys, sizeof(rr3->phys));
> > +     rr3->phys = devm_kzalloc(rr3->dev, 64, GFP_KERNEL);
> > +     if (!rr3->phys)
> > +             goto out;
> > +     usb_make_path(rr3->udev, rr3->phys, 64);
> >
> >       rc->device_name = rr3->name;
> >       rc->input_phys = rr3->phys;
> >
> > ---
> > base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d
> > change-id: 20261104-redrat3-input-uaf-b6d3789e63c9
> >
> > Best regards,
> > --
> > Joas Antonio dos Santos <joasantonio108@gmail.com>
> >
> >



-- 
Joas Antonio dos Santos
Cyber Security Specialist and Ethical Hacker
joasantonio108@gmail.com
LinkedIn