From nobody Sat Feb 7 06:14:13 2026 Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B6CF6340A6C for ; Sat, 10 Jan 2026 15:27:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768058839; cv=none; b=Th4qxdIqaYHv+vfZ85O8BmX4iq2/bGBX9PjfEfa3VhTuYWl307gifhEhIqpMohkcM9+qRBXfb6D6DmGf1GgHGjKEIVSpMLynKT3E6eCGtIsMITRJGw/MMmW0TepsaTRzTJUaoq+Q5HSMrR6ExCHgS423AM84nYcimgcWvS9uldI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768058839; c=relaxed/simple; bh=xu8YmLa9g/+vSRsD/1C8fTOol2NBa1KWM6qO1hoOa0g=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=mX5qYUYwfrp0IwNdivCo7Z0qpp5b3HyLbmbTUDLS+gcq+CLC5q+OIUc3Oqul4/uLsFDXwbOlStDi2jnTViHq54m1X0VvW1fStjvHE3FMNlX/wWZRF4WUAx805eFBtGD4Zx16XeVB5tYsBUR9ueSgRKhcxF6kusv3HKZ4ItWHid8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=QX8nwCoS; arc=none smtp.client-ip=209.85.214.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="QX8nwCoS" Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2a0833b5aeeso52608185ad.1 for ; Sat, 10 Jan 2026 07:27:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1768058837; x=1768663637; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=Xs1NcoSCG83oetkS9nkeOp/DwLHdbXKpQV7fIcvsjA4=; b=QX8nwCoSQoP8SmgRFl2wE+K70xsxPkoH7S/UBQ9DkkUcu82NjTCmMJlYQqfXZyWkN9 b8jPXJgUfyAbT4O3KMFPZC85PToYo06vAIHYhyoo7HwBXwGLP12RA/MAdBchuDNbGZhA 4gDWoDB5HzV/V+MvZfjf2XINJqM8i/Ixz0j9goTSNMazdofuzxEpVXpC+Bf8Eak89ZB8 WoTfJRQYE9UilO5XxB13tTEuYoQiOmVhjrzgemhFCRDxDyzHR4HMTF1hFpwSImVGef3E QTTBweR+KEPB1GL3UD9z10K+nCaNADXo0wpbdeh6jDQw5djw5Fm5pQCE8Coy2CmI1pv2 YGGA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768058837; x=1768663637; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Xs1NcoSCG83oetkS9nkeOp/DwLHdbXKpQV7fIcvsjA4=; b=mWW3amIi78j3M3ruOi0DLrVUMCvE7j5244j3IIgkcUjqVWnGBzE3NTX7p+5ewZJCHI 0rPSjc6sVtdJFiPtwjXAsxxN8kzjt/R004DgNepZLXm+OKeL7UBM3A+8w1VUWwtv3NQT xtrH7Fj68W81a75TCA4ZNY1NNkuZkrdad0Q5RoUSdztWySfkTO/V4U740/L+4ChNlZO/ EbeRBqNK28STivapALkzUVUUZBcA7fLxeX0aERLL7/V082VWZO0RIPavpgbx4fSoEsZG r8ubrotEE5R08xyoy3J0eujk9Coapgfuhgd0FfaBxO/oIu1FYzlSBgKAUBCv60isW5S7 I6EQ== X-Forwarded-Encrypted: i=1; AJvYcCUKzxA2PGmg5Dsq34d7pwD0FZpI6V2b/34oDiZZqTgeFWpXuRjXG7UJ5JgcLP9MUYt0OfUGW2vWiawdDes=@vger.kernel.org X-Gm-Message-State: AOJu0YzG5uVEi7LpzdVT2EPFlkCDJmG5QTEZ+HdQjPMhlBU8zY1lal6V AhWkpfeYhpF29LiYEKyUMP+lzPhYxnNJYCYxFuvTCEF5G0+Z0CnzvHsw X-Gm-Gg: AY/fxX4UtA9+2C7FcrcV5F5BBGaYspG73jyRTrsIaD2CejHJ0tbfGdj1zGHDxKPllNE inx1bBCvhFgCVF9tF1iattr9fqbVN6Q5B3vqwEsCplP6UqasdY0bJy7N7J7wXuCmXjFB6i3t+ZY aZ7DExgeoKYH9rsjfRaUJTBkItsKSQ0Jt3+ovwd2WbQw+5BUI0RiLnnTSQ2rFx0atpmGkJxqcr2 UHyf0gIok29+gsa0pP00nUcFzOcaQr6MpE1ufBaJWPfUOQOZxEdJ+d7g5WEYbwMnsX0kOHlwPwp MDzrDSXDZYKgAOiKuMpPqvf3aWNtIYIO8mmDgbloO0SnTBvrBRUCN7TnMW3yRY5dCbKaCso0kUz hldcsKCZwdWRUzRBytVs+OZJjSGY+x4ii+aPJDZPxmlkIKywWzrPi0Hh4uGhoLJ62S3t47ZMw5C olBCwu5RkM7roQ5A7Woi4+pgOKaXhw+fQ9FS78aQ== X-Google-Smtp-Source: AGHT+IFS7Czhg55hKmIHgUDpb396S6tfxneJqb6vjnaIo6fdMRy08wY3beDzB8AqxuS9tTnynMe9Pw== X-Received: by 2002:a17:903:3c27:b0:2a0:86cd:1e3a with SMTP id d9443c01a7336-2a3ee4b23a9mr131778325ad.44.1768058836907; Sat, 10 Jan 2026 07:27:16 -0800 (PST) Received: from name2965-Precision-7820-Tower.. ([121.185.186.233]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2a3e3c3a512sm133838105ad.10.2026.01.10.07.27.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 10 Jan 2026 07:27:16 -0800 (PST) From: Jeongjun Park To: Mauro Carvalho Chehab , Hans Verkuil Cc: Alexey Khoroshilov , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, syzbot+47321e8fd5a4c84088db@syzkaller.appspotmail.com, Jeongjun Park Subject: [PATCH v3] media: as102: fix to not free memory after the device is registered in as102_usb_probe() Date: Sun, 11 Jan 2026 00:17:53 +0900 Message-Id: <20260110151753.1274725-1-aha310510@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In as102_usb driver, the following race condition occurs: ``` CPU0 CPU1 as102_usb_probe() kzalloc(); // alloc as102_dev_t .... usb_register_dev(); fd =3D sys_open("/path/to/dev"); // open as102 fd .... usb_deregister_dev(); .... kfree(); // free as102_dev_t .... sys_close(fd); as102_release() // UAF!! as102_usb_release() kfree(); // DFB!! ``` When a USB character device registered with usb_register_dev() is later unregistered (via usb_deregister_dev() or disconnect), the device node is removed so new open() calls fail. However, file descriptors that are already open do not go away immediately: they remain valid until the last reference is dropped and the driver's .release() is invoked. In as102, as102_usb_probe() calls usb_register_dev() and then, on an error path, does usb_deregister_dev() and frees as102_dev_t right away. If userspace raced a successful open() before the deregistration, that open FD will later hit as102_release() --> as102_usb_release() and access or free as102_dev_t again, occur a race to use-after-free and double-free vuln. The fix is to never kfree(as102_dev_t) directly once usb_register_dev() has succeeded. After deregistration, defer freeing memory to .release(). In other words, let release() perform the last kfree when the final open FD is closed. Cc: Reported-by: syzbot+47321e8fd5a4c84088db@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3D47321e8fd5a4c84088db Fixes: cd19f7d3e39b ("[media] as102: fix leaks at failure paths in as102_us= b_probe()") Signed-off-by: Jeongjun Park --- v3: Add missing initialize intf pointer - Link to v2: https://lore.kernel.org/all/20250904054629.3849431-1-aha31051= 0@gmail.com/ v2: Fix incorrect patch description style and CC stable mailing list - Link to v1: https://lore.kernel.org/all/20250822143539.1157329-1-aha31051= 0@gmail.com/ --- drivers/media/usb/as102/as102_usb_drv.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/media/usb/as102/as102_usb_drv.c b/drivers/media/usb/as= 102/as102_usb_drv.c index e0ef66a522e2..44565f0297cd 100644 --- a/drivers/media/usb/as102/as102_usb_drv.c +++ b/drivers/media/usb/as102/as102_usb_drv.c @@ -403,7 +403,9 @@ static int as102_usb_probe(struct usb_interface *intf, failed_dvb: as102_free_usb_stream_buffer(as102_dev); failed_stream: + usb_set_intfdata(intf, NULL); usb_deregister_dev(intf, &as102_usb_class_driver); + return ret; failed: usb_put_dev(as102_dev->bus_adap.usb_dev); usb_set_intfdata(intf, NULL); --