[PATCH] media: rc: igorplugusb: fix memory corruption race condition in probe

[PATCH] media: rc: igorplugusb: fix memory corruption race condition in probe

[Rohaniyaa]

From: Rohan Mithari <rohanmithari09@gmail.com>

Syzbot reported a race condition causing a WARNING in usb_submit_urb.

In igorplugusb_probe(), the driver registers the RC device via
rc_register_device() before initializing the internal interface data
via usb_set_intfdata().

If the device is abruptly disconnected or accessed by userspace
immediately after registration, the disconnect function or active URB
submission can trigger a NULL pointer dereference or Use-After-Free.
Without KASAN enabled, this race condition silently corrupts the slab
allocator, leading to a delayed fatal panic in kmem_cache_alloc().

This patch fixes the race by ensuring the private data (ir) is safely
attached to the USB interface and the hardware is fully initialized
before exposing the device to the subsystem via rc_register_device().

Reported-by: syzbot+5d7eece664082e0c5c1a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5d7eece664082e0c5c1a

Signed-off-by: Rohan Mithari <rohanmithari09@gmail.com>
---
 drivers/media/rc/igorplugusb.c | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/drivers/media/rc/igorplugusb.c b/drivers/media/rc/igorplugusb.c
index 3e10f6fe89f8..a694ed1e5c1f 100644
--- a/drivers/media/rc/igorplugusb.c
+++ b/drivers/media/rc/igorplugusb.c
@@ -214,17 +214,14 @@ static int igorplugusb_probe(struct usb_interface *intf,
 	rc->rx_resolution = 85;
 
 	ir->rc = rc;
+	usb_set_intfdata(intf, ir);
+	igorplugusb_cmd(ir, SET_INFRABUFFER_EMPTY);
 	ret = rc_register_device(rc);
 	if (ret) {
 		dev_err(&intf->dev, "failed to register rc device: %d", ret);
 		goto fail;
-	}
-
-	usb_set_intfdata(intf, ir);
-
-	igorplugusb_cmd(ir, SET_INFRABUFFER_EMPTY);
-
-	return 0;
+}
+return 0;
 fail:
 	usb_poison_urb(ir->urb);
 	timer_delete(&ir->timer);
@@ -233,8 +230,7 @@ static int igorplugusb_probe(struct usb_interface *intf,
 	rc_free_device(ir->rc);
 	kfree(ir->buf_in);
 	kfree(ir->request);
-
-	return ret;
+return ret;
 }
 
 static void igorplugusb_disconnect(struct usb_interface *intf)
-- 
2.34.1

Re: [PATCH] media: rc: igorplugusb: fix memory corruption race condition in probe

[Sean Young]

Hi,

On Sun, Apr 05, 2026 at 12:05:07AM +0530, Rohaniyaa wrote:
> From: Rohan Mithari <rohanmithari09@gmail.com>
> 
> Syzbot reported a race condition causing a WARNING in usb_submit_urb.
> 
> In igorplugusb_probe(), the driver registers the RC device via
> rc_register_device() before initializing the internal interface data
> via usb_set_intfdata().
> 
> If the device is abruptly disconnected or accessed by userspace
> immediately after registration, the disconnect function or active URB
> submission can trigger a NULL pointer dereference or Use-After-Free.
> Without KASAN enabled, this race condition silently corrupts the slab
> allocator, leading to a delayed fatal panic in kmem_cache_alloc().
> 
> This patch fixes the race by ensuring the private data (ir) is safely
> attached to the USB interface and the hardware is fully initialized
> before exposing the device to the subsystem via rc_register_device().
> 
> Reported-by: syzbot+5d7eece664082e0c5c1a@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=5d7eece664082e0c5c1a
> 
> Signed-off-by: Rohan Mithari <rohanmithari09@gmail.com>
> ---
>  drivers/media/rc/igorplugusb.c | 14 +++++---------
>  1 file changed, 5 insertions(+), 9 deletions(-)
> 
> diff --git a/drivers/media/rc/igorplugusb.c b/drivers/media/rc/igorplugusb.c
> index 3e10f6fe89f8..a694ed1e5c1f 100644
> --- a/drivers/media/rc/igorplugusb.c
> +++ b/drivers/media/rc/igorplugusb.c
> @@ -214,17 +214,14 @@ static int igorplugusb_probe(struct usb_interface *intf,
>  	rc->rx_resolution = 85;
>  
>  	ir->rc = rc;
> +	usb_set_intfdata(intf, ir);
> +	igorplugusb_cmd(ir, SET_INFRABUFFER_EMPTY);
>  	ret = rc_register_device(rc);
>  	if (ret) {
>  		dev_err(&intf->dev, "failed to register rc device: %d", ret);
>  		goto fail;
> -	}
> -
> -	usb_set_intfdata(intf, ir);
> -
> -	igorplugusb_cmd(ir, SET_INFRABUFFER_EMPTY);
> -

I don't understand how that fixes anything.

> -	return 0;
> +}
> +return 0;

That's messy.

>  fail:
>  	usb_poison_urb(ir->urb);
>  	timer_delete(&ir->timer);
> @@ -233,8 +230,7 @@ static int igorplugusb_probe(struct usb_interface *intf,
>  	rc_free_device(ir->rc);
>  	kfree(ir->buf_in);
>  	kfree(ir->request);
> -
> -	return ret;
> +return ret;

Again, do not do that - that's messy.

Thanks,

Sean

>  }
>  
>  static void igorplugusb_disconnect(struct usb_interface *intf)
> -- 
> 2.34.1
>