Re: [PATCH] media: redrat3: fix use-after-free in rc_dev_uevent()

On Thu, Aug 06, 2026 at 04:05:25PM +0300, Dmitry Antipov wrote:
> On 8/6/26 3:55 PM, Sean Young wrote:
> 
> > you need to call rc_allocate_device() before you call redrat3_enable_detector()
> 
> If so, 'rc_unregister_device()' should be called immediately after
> 'redrat3_enable_detector()' has detected an error. That is,

So this problem is already solved in a better way by a patch I wrote which
is already out for review:

https://lkml.org/lkml/2026/7/29/1730

Sean

> 
> diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
> index 3f828a564e19..d2a805dbd3f3 100644
> --- a/drivers/media/rc/redrat3.c
> +++ b/drivers/media/rc/redrat3.c
> @@ -1111,13 +1111,16 @@ static int redrat3_dev_probe(struct usb_interface *intf,
>         /* might be all we need to do? */
>         retval = redrat3_enable_detector(rr3);
>         if (retval < 0)
> -               goto led_free;
> +               goto rc_free;
> 
>         /* we can register the device now, as it is ready */
>         usb_set_intfdata(intf, rr3);
> 
>         return 0;
> 
> +rc_free:
> +       rc_unregister_device(rr3->rc);
> +       rc_free_device(rr3->rc);
>  led_free:
>         led_classdev_unregister(&rr3->led);
>  redrat_free:
> 
> Dmitry