linux-kernel - Re: [syzbot] [media?] KASAN: use-after-free Read in em28xx_close

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251110125137-e6946c988e9f22f6d30a5fea-pchelkin@ispras>
Date: Mon, 10 Nov 2025 12:59:45 +0300
From: Fedor Pchelkin <pchelkin@...ras.ru>
To: syzbot+a11c46f37ee083a73deb@...kaller.appspotmail.com
Cc: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [media?] KASAN: use-after-free Read in
 em28xx_close_extension (2)

#syz test

--- a/drivers/media/usb/em28xx/em28xx-cards.c
+++ b/drivers/media/usb/em28xx/em28xx-cards.c
@@ -3445,17 +3445,16 @@ static void request_module_async(struct work_struct *work)
 
        /*
         * Devices with an audio-only intf also have a V4L/DVB/RC
-        * intf. Don't register extensions twice on those devices.
+        * intf.
         */
        if (dev->is_audio_only) {
 #if defined(CONFIG_MODULES) && defined(MODULE)
                request_module("em28xx-alsa");
 #endif
+               em28xx_init_extension(dev);
                return;
        }
 
-       em28xx_init_extension(dev);
-
 #if defined(CONFIG_MODULES) && defined(MODULE)
        if (dev->has_video)
                request_module("em28xx-v4l");
@@ -3469,6 +3468,8 @@ static void request_module_async(struct work_struct *work)
            ((dev->board.ir_codes || dev->board.has_ir_i2c) && !disable_ir))
                request_module("em28xx-rc");
 #endif /* CONFIG_MODULES */
+
+       em28xx_init_extension(dev);
 }
 
 static void request_modules(struct em28xx *dev)
@@ -3676,8 +3677,6 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev,
                        retval = -ENODEV;
                        goto err_deinit_media;
                }
-               em28xx_init_extension(dev);
-
                return 0;
        }