Re: [PATCH] media: redrat3: fix use-after-free in rc_dev_uevent()

On Thu, Aug 06, 2026 at 03:10:21PM +0300, Dmitry Antipov wrote:
> In 'redrat3_dev_probe()', it makes no sense to register the device
> in rc subsystem until it is completely initialized (i.e. passes
> 'redrat3_enable_detector()' successfully). Otherwise the device
> may be announced as ready to receive events even if was freed
> by 'redrat3_delete()' during error recovery after probing.

I don't think this fixes the problem properly. First of all, you enabled
the IR detector before rr3->rc is allocated, you will get null deferences
in ir_raw_event_store() in the usb callbacks. So you need to call
rc_allocate_device() before you call redrat3_enable_detector().

Secondly you need to explain better how this patch solves the problem,
because I don't understand why it would fix anything at all.

Sena


> 
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=237c754233330b2bf565
> Fixes: 8a21ec9bb3ec ("[media] redrat3: fix error paths in probe")
> Signed-off-by: Dmitry Antipov <[email protected]>
> ---
>  drivers/media/rc/redrat3.c | 11 +++++------
>  1 file changed, 5 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
> index 3f828a564e19..34ea8fe9aa18 100644
> --- a/drivers/media/rc/redrat3.c
> +++ b/drivers/media/rc/redrat3.c
> @@ -1102,18 +1102,17 @@ static int redrat3_dev_probe(struct usb_interface *intf,
>  	if (retval)
>  		goto redrat_free;
>  
> -	rr3->rc = redrat3_init_rc_dev(rr3);
> -	if (!rr3->rc) {
> -		retval = -ENOMEM;
> -		goto led_free;
> -	}
> -
>  	/* might be all we need to do? */
>  	retval = redrat3_enable_detector(rr3);
>  	if (retval < 0)
>  		goto led_free;
>  
>  	/* we can register the device now, as it is ready */
> +	rr3->rc = redrat3_init_rc_dev(rr3);
> +	if (!rr3->rc) {
> +		retval = -ENOMEM;
> +		goto led_free;
> +	}
>  	usb_set_intfdata(intf, rr3);
>  
>  	return 0;
> -- 
> 2.55.0