Re: [BUG] media: rc: redrat3: KASAN use-after-free in rc_dev_uevent after probe failure

[Sean Young <sean@mess.org>]

On Tue, Sep 01, 2026 at 05:40:40PM +0800, CJ Liu wrote:
> 
> 
> Hi,
> 
> I am reporting a KASAN slab-use-after-free triggered by a syzkaller USB
> reproducer on Linux 7.2. The issue is reproducible with HEAD commit
> 45c13f3f9e3bb15fd89ff2864c6f627a3b4b4229.
> 
> The reproducer connects a crafted USB device that is bound to the RedRat3
> infrared receiver driver. During probe, the device reports invalid endpoint
> properties and then fails several hardware communication steps. The driver
> eventually fails probe with -EIO.
> 
> After the failed probe, systemd-journal reads the device uevent file. This
> reaches rc_dev_uevent(), then add_uevent_var(), vsnprintf(), and string().
> KASAN reports a slab-use-after-free while string() reads a pointer that was
> allocated and freed in redrat3_dev_probe().
> 
> This looks like a lifetime issue in the RedRat3 probe failure path. The
> driver appears to free an object or string while it can still be referenced
> from the rc/input/device uevent path. A failed probe should make sure that
> no sysfs/uevent-visible field points to memory that has already been freed.

I am fairly sure this issue is fixed by this commit:

https://gitlab.freedesktop.org/linux-media/media-committers/-/commit/af452b9e01331b5338a1e5141624f17607239207

It was only merged a few hours ago.

Thank you for reporting.

Sean