From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794061571; b=daGLzF4okhHMUWZZIV9nVYZNNou+4MCe9i1mxhn50rR9xHnXqf7u9r/3jxtJPupxmJd6 MJsXFXlY9iTNWMjQx+rTSU8v6OyhPozP+p4sIMNYo7pWlE6OnicJzZr4SPqWPw5Ld4WKT TJQ009WEKuhJv9yB3xvGyfatF8q0abVdw8Iv20Og7zAY8GG33xdD9fmaLi9OF1U1ofHJi fans4JMFRJ6tbgA9+1d1YQdbYjnfwe5GcXHJbWhYLZ6j06d3rxyTRi3C3DuzbhKhTkAVD WOAckrfQFpD7xpwF1GyR35QaTRnaI1hpdexaRrYKqJzCdZ33ZwFBXDABcgNmB3/h7AQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794061571; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=tfFb/lLIWqb9s+HBJrylwjTleWEdqtOCNssr6VOrN+8=; b=udzh/rKf1Bmh2fQXv7zhYRgBN5AnrBu2yClbfgTPbUQyo7aJXgqQqDUK5HHnEEl1iFme 5mYyl6Pa7QQf/xsxy6qnj49iNtU6iBW0dVK4D6bjWTwOUMv5Pp0iEi0Wl9srMkUisMISV X7D11Q+x214JJDWnBc9R9+aOvUIdw64cEx2R2ifsy7cTk2N3XS4UUQ2tmxF2wWamCew8Y pRHkQyBEhW+960IcsQELYYZvo5sCaRotXYlvlIOr0hB6SLWjdL9QHq6eE6qhKLAMFpgEt OwODiWaWXz8TveaGpV+k92PBPgu81sUYJ1HBEmvsWMTE5alDZIhN0SpRLOReFFpkxaw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b="dN//zBzR"; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 99A73606A326; Sat, 7 Nov 2026 14:26:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=dN//zBzR Received: by smtp.kernel.org (Postfix) with ESMTPSA id 48A761F0089F; Sat, 7 Nov 2026 14:26:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794061571; bh=tfFb/lLIWqb9s+HBJrylwjTleWEdqtOCNssr6VOrN+8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=dN//zBzRL1hOa8pwIG3HWhlplXHnFwlRtEsAJxjpnACfPM5Qv0HD3bxpnaf8fBb1Z Pwquzh9Q9Dks2A4y8WtYX/WNQV/5jWC70H0lV31E7oeWFROJcRmimE0lTels6dVkk0 vhzwE1hpywDNGVQE52TDRCcbsx440fayIj9jleNM= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, syzbot+302b9b575a06733ff60c@syzkaller.appspotmail.com, Rik van Riel , Sean Young Subject: [PATCH 6.12 0649/1536] media: redrat3: fix UAF in probe error path leaving rc device registered Date: Sat, 7 Nov 2026 08:44:25 -0500 Message-ID: <20261107135015.756463801@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134957.653319350@linuxfoundation.org> References: <20261107134957.653319350@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Rik van Riel commit af452b9e01331b5338a1e5141624f17607239207 upstream. redrat3 stores its device name and phys path inside the main rr3 structure, and the rc device's device_name and input_phys point into rr3. When the RC device is registered, it keeps those pointers. KASAN: slab-use-after-free in string_nocheck lib/vsprintf.c:648 Read of size 1 at addr ffff888051fda758 by task udevd/7464 Call Trace: string_nocheck lib/vsprintf.c:648 [inline] string+0x216/0x2d0 lib/vsprintf.c:730 vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945 vscnprintf+0x41/0x90 lib/vsprintf.c:3014 sysfs_emit+0x10e/0x180 fs/sysfs/file.c:761 input_dev_show_name+0x58/0x70 drivers/input/input.c:1282 Allocated by task 10: redrat3_dev_probe+0x477/0x2570 drivers/media/rc/redrat3.c:1023 Freed by task 10: redrat3_delete drivers/media/rc/redrat3.c:466 [inline] redrat3_dev_probe+0x1bf4/0x2570 drivers/media/rc/redrat3.c:1124 Syzkaller triggers this via usb probing. It probes the RedRat3 USB interface, which calls redrat3_dev_probe() in redrat3.c. That function allocates rr3, then builds an rc device whose name points into rr3 via redrat3_init_rc_dev() in redrat3.c, and registers it with rc_register_device(). When the detector enable fails after the RC device is registered, the probe jumps to the led_free path. That path unregisters the LED but does not unregister the RC device before freeing rr3 via redrat3_delete() in redrat3.c. The RC device still holds device_name = rr3->name which is now freed. Later udevd reads /sys/.../input device name via sysfs_emit() in file.c, which calls input_dev_show_name() in input.c, which emits dev->name which is the freed rr3->name. When the detector enable fails after the RC device is registered, the error path must not leave the RC device registered. Make the probe error path clean up the same way redrat3_dev_disconnect() does. This change should be safe because the RC device is fully registered at this point and its teardown via rc_unregister_device() is protected by the input device mutex, and rr3 is still alive during unregister so device_name remains valid until after unregister. The URBs are killed before rc_free, so no completion can run after rc is freed. No new lock ordering is introduced. Reported-by: syzbot+302b9b575a06733ff60c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=302b9b575a06733ff60c Link: https://lore.kernel.org/all/6a74a76d.ec7c9571.3ac9bb.0056.GAE@google.com/ Fixes: 2154be651b90 ("[media] redrat3: new rc-core IR transceiver device driver") Cc: stable@vger.kernel.org Assisted-by: Hermes:muse-spark-1.2 syzkaller Signed-off-by: Rik van Riel Signed-off-by: Sean Young Signed-off-by: Greg Kroah-Hartman --- drivers/media/rc/redrat3.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/media/rc/redrat3.c +++ b/drivers/media/rc/redrat3.c @@ -977,6 +977,7 @@ static int redrat3_dev_probe(struct usb_ struct device *dev = &intf->dev; struct usb_host_interface *uhi; struct redrat3_dev *rr3; + struct rc_dev *rc; struct usb_endpoint_descriptor *ep; struct usb_endpoint_descriptor *ep_narrow = NULL; struct usb_endpoint_descriptor *ep_wide = NULL; @@ -1121,9 +1122,12 @@ static int redrat3_dev_probe(struct usb_ return 0; led_free: + rc_unregister_device(rr3->rc); led_classdev_unregister(&rr3->led); redrat_free: + rc = rr3->rc; redrat3_delete(rr3, rr3->udev); + rc_free_device(rc); no_endpoints: return retval;