Re: [PATCH v2] media: redrat3: fix UAF in probe error path leaving rc device registered

[Sean Young]

On Thu, Aug 13, 2026 at 02:34:52PM -0400, Rik van Riel wrote:
> On Thu, 2026-08-13 at 15:02 +0100, Sean Young wrote:
> > > https://lore.kernel.org/all/6a74a76d.ec7c9571.3ac9bb.0056.GAE@xxxxxxxxxx/
> > > Fixes: 2154be651b90 ("[media] redrat3: new rc-core IR transceiver
> > > device driver")
> > > Cc: stable@xxxxxxxxxxxxxxx
> > > Assisted-by: Hermes:muse-spark-1.2 syzkaller
> > > Signed-off-by: Rik van Riel <riel@xxxxxxxxxxx>
> > 
> > The commit message is very good. Your patch is very similar to a
> > patch
> > I wrote earlier (which still has to be reviewed, I can't merge my
> > own patches without review into the media-committer tree):
> > 
> > https://lkml.org/lkml/2026/7/29/1730 ;
> > 
> > I don't really have a preference for which one to merge. 
> 
> If it's any consolation, Sashiko suggests there
> is another race condition left, pre-existing in
> the code.
> 
> https://sashiko.dev/#/patchset/20260808232031.500f781c%40fangorn
> 
> I would be happy to review patches to fix that.

Thank you. I've think I've got all them covered. The first series
is here:

	https://lore.kernel.org/all/cover.1785338381.git.sean@xxxxxxxx/

I've got another series almost ready to go (mostly locking issues).

For more than 10 years I've been working on rc-core (on and off) and
I convinced myself it was pretty solid. It turns out that I was
deluded and Sashiko found lots of embarrasing problems. It's a shame
that I can't prompt Sashiko to find all bugs in rc-core. I have used
claude, and it found problems sashiko missed (and vice versa). 19
patches so far for problems llms found, which is a lot for a small
subsystem.


Sean