[PATCH] media: redrat3: fix use-after-free in rc_dev_uevent()

[PATCH] media: redrat3: fix use-after-free in rc_dev_uevent()

[Dmitry Antipov]

In 'redrat3_dev_probe()', it makes no sense to register the device
in rc subsystem until it is completely initialized (i.e. passes
'redrat3_enable_detector()' successfully). Otherwise the device
may be announced as ready to receive events even if was freed
by 'redrat3_delete()' during error recovery after probing.

Reported-by: syzbot+237c754233330b2bf565@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=237c754233330b2bf565
Fixes: 8a21ec9bb3ec ("[media] redrat3: fix error paths in probe")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
---
 drivers/media/rc/redrat3.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
index 3f828a564e19..34ea8fe9aa18 100644
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -1102,18 +1102,17 @@ static int redrat3_dev_probe(struct usb_interface *intf,
 	if (retval)
 		goto redrat_free;
 
-	rr3->rc = redrat3_init_rc_dev(rr3);
-	if (!rr3->rc) {
-		retval = -ENOMEM;
-		goto led_free;
-	}
-
 	/* might be all we need to do? */
 	retval = redrat3_enable_detector(rr3);
 	if (retval < 0)
 		goto led_free;
 
 	/* we can register the device now, as it is ready */
+	rr3->rc = redrat3_init_rc_dev(rr3);
+	if (!rr3->rc) {
+		retval = -ENOMEM;
+		goto led_free;
+	}
 	usb_set_intfdata(intf, rr3);
 
 	return 0;
-- 
2.55.0

Re: [PATCH] media: redrat3: fix use-after-free in rc_dev_uevent()

[Sean Young]

On Thu, Aug 06, 2026 at 03:10:21PM +0300, Dmitry Antipov wrote:
> In 'redrat3_dev_probe()', it makes no sense to register the device
> in rc subsystem until it is completely initialized (i.e. passes
> 'redrat3_enable_detector()' successfully). Otherwise the device
> may be announced as ready to receive events even if was freed
> by 'redrat3_delete()' during error recovery after probing.

I don't think this fixes the problem properly. First of all, you enabled
the IR detector before rr3->rc is allocated, you will get null deferences
in ir_raw_event_store() in the usb callbacks. So you need to call
rc_allocate_device() before you call redrat3_enable_detector().

Secondly you need to explain better how this patch solves the problem,
because I don't understand why it would fix anything at all.

Sena


> 
> Reported-by: syzbot+237c754233330b2bf565@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=237c754233330b2bf565
> Fixes: 8a21ec9bb3ec ("[media] redrat3: fix error paths in probe")
> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
> ---
>  drivers/media/rc/redrat3.c | 11 +++++------
>  1 file changed, 5 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
> index 3f828a564e19..34ea8fe9aa18 100644
> --- a/drivers/media/rc/redrat3.c
> +++ b/drivers/media/rc/redrat3.c
> @@ -1102,18 +1102,17 @@ static int redrat3_dev_probe(struct usb_interface *intf,
>  	if (retval)
>  		goto redrat_free;
>  
> -	rr3->rc = redrat3_init_rc_dev(rr3);
> -	if (!rr3->rc) {
> -		retval = -ENOMEM;
> -		goto led_free;
> -	}
> -
>  	/* might be all we need to do? */
>  	retval = redrat3_enable_detector(rr3);
>  	if (retval < 0)
>  		goto led_free;
>  
>  	/* we can register the device now, as it is ready */
> +	rr3->rc = redrat3_init_rc_dev(rr3);
> +	if (!rr3->rc) {
> +		retval = -ENOMEM;
> +		goto led_free;
> +	}
>  	usb_set_intfdata(intf, rr3);
>  
>  	return 0;
> -- 
> 2.55.0

Re: [PATCH] media: redrat3: fix use-after-free in rc_dev_uevent()

[Dmitry Antipov]

On 8/6/26 3:55 PM, Sean Young wrote:

> you need to call rc_allocate_device() before you call redrat3_enable_detector()

If so, 'rc_unregister_device()' should be called immediately after
'redrat3_enable_detector()' has detected an error. That is,

diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
index 3f828a564e19..d2a805dbd3f3 100644
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -1111,13 +1111,16 @@ static int redrat3_dev_probe(struct usb_interface *intf,
         /* might be all we need to do? */
         retval = redrat3_enable_detector(rr3);
         if (retval < 0)
-               goto led_free;
+               goto rc_free;

         /* we can register the device now, as it is ready */
         usb_set_intfdata(intf, rr3);

         return 0;

+rc_free:
+       rc_unregister_device(rr3->rc);
+       rc_free_device(rr3->rc);
  led_free:
         led_classdev_unregister(&rr3->led);
  redrat_free:

Dmitry

Re: [PATCH] media: redrat3: fix use-after-free in rc_dev_uevent()

[Sean Young]

On Thu, Aug 06, 2026 at 04:05:25PM +0300, Dmitry Antipov wrote:
> On 8/6/26 3:55 PM, Sean Young wrote:
> 
> > you need to call rc_allocate_device() before you call redrat3_enable_detector()
> 
> If so, 'rc_unregister_device()' should be called immediately after
> 'redrat3_enable_detector()' has detected an error. That is,

So this problem is already solved in a better way by a patch I wrote which
is already out for review:

https://lkml.org/lkml/2026/7/29/1730

Sean

> 
> diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
> index 3f828a564e19..d2a805dbd3f3 100644
> --- a/drivers/media/rc/redrat3.c
> +++ b/drivers/media/rc/redrat3.c
> @@ -1111,13 +1111,16 @@ static int redrat3_dev_probe(struct usb_interface *intf,
>         /* might be all we need to do? */
>         retval = redrat3_enable_detector(rr3);
>         if (retval < 0)
> -               goto led_free;
> +               goto rc_free;
> 
>         /* we can register the device now, as it is ready */
>         usb_set_intfdata(intf, rr3);
> 
>         return 0;
> 
> +rc_free:
> +       rc_unregister_device(rr3->rc);
> +       rc_free_device(rr3->rc);
>  led_free:
>         led_classdev_unregister(&rr3->led);
>  redrat_free:
> 
> Dmitry