Re: [PATCH] media: rc: redrat3: fix use-after-free of input device name/phys strings
From: Joas Antonio
Date: Sun Nov 08 2026 - 11:45:25 EST
Hi Sean,
You're right, I apologize for the incorrect analysis.
rc_unregister_device() calls input_unregister_device() before
redrat3_delete() frees the struct, so EVIOCGNAME cannot reach
the freed name/phys strings via the disconnect path.
Thank you for pointing to af452b9e01331b — I should have checked
the probe error path more carefully.
Regards,
Joas
Em dom., 8 de nov. de 2026 às 11:06, Sean Young <sean@xxxxxxxx> escreveu:
>
> On Wed, Nov 04, 2026 at 09:03:01PM +0000, Joas Antonio dos Santos via B4 Relay wrote:
> > From: Joas Antonio dos Santos <joasantonio108@xxxxxxxxx>
> >
> > redrat3_init_rc_dev() sets rc->device_name and rc->input_phys to point
> > at the name[] and phys[] arrays embedded in struct redrat3_dev.
> > rc_prepare_rx_device() then copies these pointers into input_dev->name
> > and input_dev->phys without duplicating the strings.
> >
> > When redrat3_dev_disconnect() runs, it calls redrat3_delete() which
> > kfrees the redrat3_dev struct, freeing the embedded name and phys
> > arrays. If an evdev client still holds the input device open, a
> > subsequent EVIOCGNAME or EVIOCGPHYS ioctl calls str_to_user() which
> > reads the freed string via strlen(), triggering a KASAN
> > slab-use-after-free on the freed kmalloc-2k object.
>
> This is nonsense. rc_unregister_device() calls input_unregister_device()
> so EVIOCGNAME will not work any more.
>
> My guess this syzbot issue is resolved by commit
> af452b9e01331b5338a1e5141624f17607239207 and this is the error path in probe,
> not disconnect..
>
>
> Sean
>
> >
> > Fix by allocating the name and phys strings with devm_kasprintf() and
> > devm_kzalloc() respectively, tied to the USB interface device lifetime.
> > This ensures the strings outlive the input device, since the USB
> > interface device (and its devres) is not released until all references
> > to it are dropped.
> >
> > Found by LLM-assisted code review of syzbot-reported crash patterns.
> >
> > Reported-by: syzbot+aec1962419768c5caf88@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Closes: https://syzkaller.appspot.com/bug?extid=aec1962419768c5caf88
> > Fixes: 2154be651bfd ("[media] redrat3: new driver")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Joas Antonio dos Santos <joasantonio108@xxxxxxxxx>
> > ---
> > redrat3_init_rc_dev() stores pointers to the name[] and phys[] arrays
> > embedded in struct redrat3_dev into rc->device_name and rc->input_phys.
> > These are copied into input_dev->name/phys without duplication.
> >
> > When the device disconnects, kfree(rr3) frees the strings while evdev
> > may still hold the input device open. A subsequent EVIOCGNAME ioctl
> > dereferences the freed string via str_to_user() -> strlen(), triggering
> > a KASAN slab-use-after-free.
> >
> > syzbot link: https://syzkaller.appspot.com/bug?extid=aec1962419768c5caf88
> > ---
> > drivers/media/rc/redrat3.c | 17 +++++++++++------
> > 1 file changed, 11 insertions(+), 6 deletions(-)
> >
> > diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
> > index 3e82b5e66..d9e37ede2 100644
> > --- a/drivers/media/rc/redrat3.c
> > +++ b/drivers/media/rc/redrat3.c
> > @@ -229,8 +229,8 @@ struct redrat3_dev {
> >
> > u32 carrier;
> >
> > - char name[64];
> > - char phys[64];
> > + char *name;
> > + char *phys;
> > };
> >
> > static void redrat3_dump_fw_error(struct redrat3_dev *rr3, int code)
> > @@ -943,11 +943,16 @@ static struct rc_dev *redrat3_init_rc_dev(struct redrat3_dev *rr3)
> > if (!rc)
> > return NULL;
> >
> > - snprintf(rr3->name, sizeof(rr3->name),
> > - "RedRat3%s Infrared Remote Transceiver",
> > - prod == USB_RR3IIUSB_PRODUCT_ID ? "-II" : "");
> > + rr3->name = devm_kasprintf(rr3->dev, GFP_KERNEL,
> > + "RedRat3%s Infrared Remote Transceiver",
> > + prod == USB_RR3IIUSB_PRODUCT_ID ? "-II" : "");
> > + if (!rr3->name)
> > + goto out;
> >
> > - usb_make_path(rr3->udev, rr3->phys, sizeof(rr3->phys));
> > + rr3->phys = devm_kzalloc(rr3->dev, 64, GFP_KERNEL);
> > + if (!rr3->phys)
> > + goto out;
> > + usb_make_path(rr3->udev, rr3->phys, 64);
> >
> > rc->device_name = rr3->name;
> > rc->input_phys = rr3->phys;
> >
> > ---
> > base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d
> > change-id: 20261104-redrat3-input-uaf-b6d3789e63c9
> >
> > Best regards,
> > --
> > Joas Antonio dos Santos <joasantonio108@xxxxxxxxx>
> >
> >
--
Joas Antonio dos Santos
Cyber Security Specialist and Ethical Hacker
joasantonio108@xxxxxxxxx