[PATCH] media: rc: igorplugusb: fix memory corruption race condition in probe

[Rohaniyaa <rohanmithari09@gmail.com>]

From: Rohan Mithari <rohanmithari09@gmail.com>

Syzbot reported a race condition causing a WARNING in usb_submit_urb.

In igorplugusb_probe(), the driver registers the RC device via
rc_register_device() before initializing the internal interface data
via usb_set_intfdata().

If the device is abruptly disconnected or accessed by userspace
immediately after registration, the disconnect function or active URB
submission can trigger a NULL pointer dereference or Use-After-Free.
Without KASAN enabled, this race condition silently corrupts the slab
allocator, leading to a delayed fatal panic in kmem_cache_alloc().

This patch fixes the race by ensuring the private data (ir) is safely
attached to the USB interface and the hardware is fully initialized
before exposing the device to the subsystem via rc_register_device().

Reported-by: syzbot+5d7eece664082e0c5c1a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5d7eece664082e0c5c1a

Signed-off-by: Rohan Mithari <rohanmithari09@gmail.com>
---
 drivers/media/rc/igorplugusb.c | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/drivers/media/rc/igorplugusb.c b/drivers/media/rc/igorplugusb.c
index 3e10f6fe89f8..a694ed1e5c1f 100644
--- a/drivers/media/rc/igorplugusb.c
+++ b/drivers/media/rc/igorplugusb.c
@@ -214,17 +214,14 @@ static int igorplugusb_probe(struct usb_interface *intf,
 	rc->rx_resolution = 85;
 
 	ir->rc = rc;
+	usb_set_intfdata(intf, ir);
+	igorplugusb_cmd(ir, SET_INFRABUFFER_EMPTY);
 	ret = rc_register_device(rc);
 	if (ret) {
 		dev_err(&intf->dev, "failed to register rc device: %d", ret);
 		goto fail;
-	}
-
-	usb_set_intfdata(intf, ir);
-
-	igorplugusb_cmd(ir, SET_INFRABUFFER_EMPTY);
-
-	return 0;
+}
+return 0;
 fail:
 	usb_poison_urb(ir->urb);
 	timer_delete(&ir->timer);
@@ -233,8 +230,7 @@ static int igorplugusb_probe(struct usb_interface *intf,
 	rc_free_device(ir->rc);
 	kfree(ir->buf_in);
 	kfree(ir->request);
-
-	return ret;
+return ret;
 }
 
 static void igorplugusb_disconnect(struct usb_interface *intf)
-- 
2.34.1