Re: [PATCH] media: redrat3: fix use-after-free in rc_dev_uevent()

On 8/6/26 3:55 PM, Sean Young wrote:

> you need to call rc_allocate_device() before you call redrat3_enable_detector()

If so, 'rc_unregister_device()' should be called immediately after
'redrat3_enable_detector()' has detected an error. That is,

diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
index 3f828a564e19..d2a805dbd3f3 100644
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -1111,13 +1111,16 @@ static int redrat3_dev_probe(struct usb_interface *intf,
         /* might be all we need to do? */
         retval = redrat3_enable_detector(rr3);
         if (retval < 0)
-               goto led_free;
+               goto rc_free;

         /* we can register the device now, as it is ready */
         usb_set_intfdata(intf, rr3);

         return 0;

+rc_free:
+       rc_unregister_device(rr3->rc);
+       rc_free_device(rr3->rc);
  led_free:
         led_classdev_unregister(&rr3->led);
  redrat_free:

Dmitry