Re: [syzbot] [media?] KASAN: use-after-free Read in em28xx_close_extension (2)

Fedor Pchelkin
2025-11-10T09:59:48Z

#syz test

--- a/drivers/media/usb/em28xx/em28xx-cards.c
+++ b/drivers/media/usb/em28xx/em28xx-cards.c
@@ -3445,17 +3445,16 @@ static void request_module_async(struct work_struct *work)

/*
* Devices with an audio-only intf also have a V4L/DVB/RC
- * intf. Don't register extensions twice on those devices.
+ * intf.
*/
if (dev->is_audio_only) {
#if defined(CONFIG_MODULES) && defined(MODULE)
request_module("em28xx-alsa");
#endif
+ em28xx_init_extension(dev);
return;
}

- em28xx_init_extension(dev);
-
#if defined(CONFIG_MODULES) && defined(MODULE)
if (dev->has_video)
request_module("em28xx-v4l");
@@ -3469,6 +3468,8 @@ static void request_module_async(struct work_struct *work)
((dev->board.ir_codes || dev->board.has_ir_i2c) && !disable_ir))
request_module("em28xx-rc");
#endif /* CONFIG_MODULES */
+
+ em28xx_init_extension(dev);
}

static void request_modules(struct em28xx *dev)
@@ -3676,8 +3677,6 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,
retval = -ENODEV;
goto err_deinit_media;
}
- em28xx_init_extension(dev);
-
return 0;
}