Re: [PATCH] media: redrat3: fix UAF in probe error path leaving rc device registered

[Rik van Riel]

On Sat, 2026-08-08 at 17:42 -0400, Rik van Riel wrote:
> redrat3 stores its device name and phys path inside the main rr3
> structure, and the rc device's device_name and input_phys point into
> rr3. When the RC device is registered, it keeps those pointers.
> 
>   KASAN: slab-use-after-free in string_nocheck lib/vsprintf.c:648
>   Read of size 1 at addr ffff888051fda758 by task udevd/7464
>   Call Trace:
>    string_nocheck lib/vsprintf.c:648 [inline]
>    string+0x216/0x2d0 lib/vsprintf.c:730
>    vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
>    vscnprintf+0x41/0x90 lib/vsprintf.c:3014
>    sysfs_emit+0x10e/0x180 fs/sysfs/file.c:761
>    input_dev_show_name+0x58/0x70 drivers/input/input.c:1282
> 
>   Allocated by task 10:
>    redrat3_dev_probe+0x477/0x2570 drivers/media/rc/redrat3.c:1023
>   Freed by task 10:
>    redrat3_delete drivers/media/rc/redrat3.c:466 [inline]
>    redrat3_dev_probe+0x1bf4/0x2570 drivers/media/rc/redrat3.c:1124

The bug is real, but Sashiko found an issue
with my patch:

https://sashiko.dev/#/patchset/20260808174213.1d68336e%40fangorn

I'll get you a new one that fixes things right.