linux-kernel - Re: [syzbot] [media?] [usb?] KASAN: slab-use-after-free Read in v4l2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250126161240.365644-1-n.zhandarovich@fintech.ru>
Date: Sun, 26 Jan 2025 08:12:40 -0800
From: Nikita Zhandarovich <n.zhandarovich@...tech.ru>
To: <syzbot+6b52c2b24e341804a58c@...kaller.appspotmail.com>
CC: Nikita Zhandarovich <n.zhandarovich@...tech.ru>,
	<syzkaller-bugs@...glegroups.com>, <linux-kernel@...r.kernel.org>
Subject: Re: [syzbot] [media?] [usb?] KASAN: slab-use-after-free Read in v4l2_release

Try fixing the order of releasing things in case of a faulty
device registation.

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
---
 drivers/media/usb/hackrf/hackrf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/hackrf/hackrf.c b/drivers/media/usb/hackrf/hackrf.c
index 0b50de8775a3..bc910b35f605 100644
--- a/drivers/media/usb/hackrf/hackrf.c
+++ b/drivers/media/usb/hackrf/hackrf.c
@@ -1513,12 +1513,12 @@ static int hackrf_probe(struct usb_interface *intf,
 	return 0;
 err_video_unregister_device_rx:
 	video_unregister_device(&dev->rx_vdev);
-err_v4l2_device_unregister:
-	v4l2_device_unregister(&dev->v4l2_dev);
 err_v4l2_ctrl_handler_free_tx:
 	v4l2_ctrl_handler_free(&dev->tx_ctrl_handler);
 err_v4l2_ctrl_handler_free_rx:
 	v4l2_ctrl_handler_free(&dev->rx_ctrl_handler);
+err_v4l2_device_unregister:
+	v4l2_device_unregister(&dev->v4l2_dev);
 err_kfree:
 	kfree(dev);
 err: