[lvc-project] [PATCH] media: redrat3: fix use-after-free in rc_dev_uevent()

[Dmitry Antipov]

In 'redrat3_dev_probe()', it makes no sense to register the device
in rc subsystem until it is completely initialized (i.e. passes
'redrat3_enable_detector()' successfully). Otherwise the device
may be announced as ready to receive events even if was freed
by 'redrat3_delete()' during error recovery after probing.

Reported-by: syzbot+237c754233330b2bf565 at syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=237c754233330b2bf565
Fixes: 8a21ec9bb3ec ("[media] redrat3: fix error paths in probe")
Signed-off-by: Dmitry Antipov <dmantipov at yandex.ru>
---
 drivers/media/rc/redrat3.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
index 3f828a564e19..34ea8fe9aa18 100644
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -1102,18 +1102,17 @@ static int redrat3_dev_probe(struct usb_interface *intf,
 	if (retval)
 		goto redrat_free;
 
-	rr3->rc = redrat3_init_rc_dev(rr3);
-	if (!rr3->rc) {
-		retval = -ENOMEM;
-		goto led_free;
-	}
-
 	/* might be all we need to do? */
 	retval = redrat3_enable_detector(rr3);
 	if (retval < 0)
 		goto led_free;
 
 	/* we can register the device now, as it is ready */
+	rr3->rc = redrat3_init_rc_dev(rr3);
+	if (!rr3->rc) {
+		retval = -ENOMEM;
+		goto led_free;
+	}
 	usb_set_intfdata(intf, rr3);
 
 	return 0;
-- 
2.55.0