[BUG] media: rc: redrat3: KASAN use-after-free in rc_dev_uevent after probe failure

[CJ Liu]

Hi,

I am reporting a KASAN slab-use-after-free triggered by a syzkaller USB
reproducer on Linux 7.2. The issue is reproducible with HEAD commit
45c13f3f9e3bb15fd89ff2864c6f627a3b4b4229.

The reproducer connects a crafted USB device that is bound to the RedRat3
infrared receiver driver. During probe, the device reports invalid endpoint
properties and then fails several hardware communication steps. The driver
eventually fails probe with -EIO.

After the failed probe, systemd-journal reads the device uevent file. This
reaches rc_dev_uevent(), then add_uevent_var(), vsnprintf(), and string().
KASAN reports a slab-use-after-free while string() reads a pointer that was
allocated and freed in redrat3_dev_probe().

This looks like a lifetime issue in the RedRat3 probe failure path. The
driver appears to free an object or string while it can still be referenced
from the rc/input/device uevent path. A failed probe should make sure that
no sysfs/uevent-visible field points to memory that has already been freed.

Reproducer:

syz reproducer: 

syz_usb_connect(0x0, 0x39, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002000000402a1101000001010203010902270001010080fa0904000003ffffff00070581024000000705820240000007050302400000"], 0x0)


console output: https://pastebin.com/raw/M2wZXb12
kernel config: https://pastebin.com/raw/vDCnLVLv

Kernel:

HEAD commit: 45c13f3f9e3bb15fd89ff2864c6f627a3b4b4229
git tree: torvalds/linux
kernel version: 7.2.0-14827-g45c13f3f9e3b #1 PREEMPT(full)

Relevant log:

usb 5-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice= 1.00
usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64
usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64
usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64
redrat3 5-1:1.0: Problem fetching firmware ID
redrat3 5-1:1.0: Failed to read timeout from hardware
redrat3 5-1:1.0: redrat3_send_cmd: Error sending rr3 cmd res -71, data 0
redrat3 5-1:1.0: redrat3_enable_detector: detector status: -5, should be 1
redrat3 5-1:1.0: probe with driver redrat3 failed with error -5

==================================================================
BUG: KASAN: slab-use-after-free in string+0x231/0x2b0
Read of size 1 at addr ffff88804c7fb758 by task systemd-journal/5039

CPU: 1 UID: 0 PID: 5039 Comm: systemd-journal Tainted: G W
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009)

Call Trace:
<TASK>
dump_stack_lvl+0x10e/0x190
print_report+0x153/0x7a0
kasan_report+0x147/0x180
string+0x231/0x2b0
vsnprintf+0x704/0xea0
add_uevent_var+0x1b2/0x430
rc_dev_uevent+0x15d/0x1a0
dev_uevent+0x51e/0x860
uevent_show+0x19f/0x320
dev_attr_show+0x58/0xc0
sysfs_kf_seq_show+0x331/0x480
seq_read_iter+0x475/0xe20
vfs_read+0x59d/0xa70
ksys_read+0x14a/0x250
do_syscall_64+0xfa/0x480
entry_SYSCALL_64_after_hwframe+0x76/0x7e
</TASK>

Allocated by task 11585:
__kmalloc_cache_noprof+0x32e/0x630
redrat3_dev_probe+0x47a/0x2700
usb_probe_interface+0x71e/0xe00
really_probe+0x267/0xb20
__driver_probe_device+0x1f9/0x420
driver_probe_device+0x4f/0x240
__device_attach_driver+0x286/0x430
bus_for_each_drv+0x251/0x2e0
__device_attach+0x2b3/0x440
device_initial_probe+0xa1/0xd0
bus_probe_device+0x12a/0x220
device_add+0x7ec/0xb90
usb_new_device+0xbc6/0x1ae0
hub_event+0x2c04/0x4ef0

Freed by task 11585:
kfree+0x19a/0x660
redrat3_dev_probe+0x1590/0x2700
usb_probe_interface+0x71e/0xe00
really_probe+0x267/0xb20
__driver_probe_device+0x1f9/0x420
driver_probe_device+0x4f/0x240
__device_attach_driver+0x286/0x430
bus_for_each_drv+0x251/0x2e0
__device_attach+0x2b3/0x440
device_initial_probe+0xa1/0xd0
bus_probe_device+0x12a/0x220
device_add+0x7ec/0xb90
usb_new_device+0xbc6/0x1ae0
hub_event+0x2c04/0x4ef0

The buggy address belongs to the object at ffff88804c7fb000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1880 bytes inside of
freed 2048-byte region [ffff88804c7fb000, ffff88804c7fb800)