[PATCH 1/2] media: redrat3: unregister the rc device when probe fails

[Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>]

redrat3_dev_probe() registers the rc device, whose input device points
its name and phys at strings embedded in struct redrat3_dev, and only
then calls redrat3_enable_detector(). If that fails, the error path
frees rr3 but leaves the rc device registered and leaks it. Reading its
"uevent" attribute afterwards dereferences the freed name/phys:

  BUG: KASAN: slab-use-after-free in string+0x4a9/0x4f0
  Read of size 1 at addr ffff8880272bf758 by task repro/4968
   add_uevent_var+0x183/0x3a0
   input_dev_uevent+0x162/0x900
   dev_uevent+0x2f1/0x870
   uevent_show+0x1ca/0x3a0
   ...

Unregister and free the rc device on that path, mirroring
redrat3_dev_disconnect(): stop the URBs first, since their handlers use
the rc device, and only then unregister it.

Reproduced with a raw-gadget RedRat3 that reports detector status 0.

Fixes: 2154be651b90 ("[media] redrat3: new rc-core IR transceiver device driver")
Cc: stable@vger.kernel.org
Reported-by: syzbot+2a123f6269da57ffefaa@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2a123f6269da57ffefaa
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
---
 drivers/media/rc/redrat3.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
index 3f828a564e19..e9dd563e9cb3 100644
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -1111,13 +1111,19 @@ static int redrat3_dev_probe(struct usb_interface *intf,
 	/* might be all we need to do? */
 	retval = redrat3_enable_detector(rr3);
 	if (retval < 0)
-		goto led_free;
+		goto rc_unreg;
 
 	/* we can register the device now, as it is ready */
 	usb_set_intfdata(intf, rr3);
 
 	return 0;
 
+rc_unreg:
+	/* URB handlers use rc */
+	usb_kill_urb(rr3->narrow_urb);
+	usb_kill_urb(rr3->wide_urb);
+	rc_unregister_device(rr3->rc);
+	rc_free_device(rr3->rc);
 led_free:
 	led_classdev_unregister(&rr3->led);
 redrat_free:
-- 
2.43.0