Re: [PATCH] media: redrat3: fix UAF in probe error path leaving rc device registered
Rik van Riel <[email protected]>
| Newsgroups | org.kernel.vger.linux-media,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
On Sat, 2026-08-08 at 17:42 -0400, Rik van Riel wrote: > redrat3 stores its device name and phys path inside the main rr3 > structure, and the rc device's device_name and input_phys point into > rr3. When the RC device is registered, it keeps those pointers. > > KASAN: slab-use-after-free in string_nocheck lib/vsprintf.c:648 > Read of size 1 at addr ffff888051fda758 by task udevd/7464 > Call Trace: > string_nocheck lib/vsprintf.c:648 [inline] > string+0x216/0x2d0 lib/vsprintf.c:730 > vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945 > vscnprintf+0x41/0x90 lib/vsprintf.c:3014 > sysfs_emit+0x10e/0x180 fs/sysfs/file.c:761 > input_dev_show_name+0x58/0x70 drivers/input/input.c:1282 > > Allocated by task 10: > redrat3_dev_probe+0x477/0x2570 drivers/media/rc/redrat3.c:1023 > Freed by task 10: > redrat3_delete drivers/media/rc/redrat3.c:466 [inline] > redrat3_dev_probe+0x1bf4/0x2570 drivers/media/rc/redrat3.c:1124 The bug is real, but Sashiko found an issue with my patch: https://sashiko.dev/#/patchset/20260808174213.1d68336e%40fangorn I'll get you a new one that fixes things right.