In the Linux kernel, the following vulnerability has been resolved:
media: xc2028: avoid use-after-free in loadfirmwarecb()
syzkaller reported use-after-free in loadfirmwarecb() [1]. The reason is because the module allocated a struct tuner in tuner_probe(), and then the module initialization failed, the struct tuner was released. A worker which created during module initialization accesses this struct tuner later, it caused use-after-free.
The process is as follows:
task-6504 workerthread tunerprobe <= alloc dvbfrontend [2] ... requestfirmwarenowait <= create a worker ... tunerremove <= free dvbfrontend ... requestfirmwareworkfunc <= the firmware is ready loadfirmwarecb <= but now the dvb_frontend has been freed
To fix the issue, check the dvdfrontend in loadfirmware_cb(), if it is null, report a warning and just return.
 BUG: KASAN: use-after-free in load_firmware_cb+0x1310/0x17a0
 Read of size 8 at addr ffff8000d7ca2308 by task kworker/2:3/6504
 Call trace:
  load_firmware_cb+0x1310/0x17a0
  request_firmware_work_func+0x128/0x220
  process_one_work+0x770/0x1824
  worker_thread+0x488/0xea0
  kthread+0x300/0x430
  ret_from_fork+0x10/0x20
 Allocated by task 6504:
  kzalloc
  tuner_probe+0xb0/0x1430
  i2c_device_probe+0x92c/0xaf0
  really_probe+0x678/0xcd0
  driver_probe_device+0x280/0x370
  __device_attach_driver+0x220/0x330
  bus_for_each_drv+0x134/0x1c0
  __device_attach+0x1f4/0x410
  device_initial_probe+0x20/0x30
  bus_probe_device+0x184/0x200
  device_add+0x924/0x12c0
  device_register+0x24/0x30
  i2c_new_device+0x4e0/0xc44
  v4l2_i2c_new_subdev_board+0xbc/0x290
  v4l2_i2c_new_subdev+0xc8/0x104
  em28xx_v4l2_init+0x1dd0/0x3770
 Freed by task 6504:
  kfree+0x238/0x4e4
  tuner_remove+0x144/0x1c0
  i2c_device_remove+0xc8/0x290
  __device_release_driver+0x314/0x5fc
  device_release_driver+0x30/0x44
  bus_remove_device+0x244/0x490
  device_del+0x350/0x900
  device_unregister+0x28/0xd0
  i2c_unregister_device+0x174/0x1d0
  v4l2_device_unregister+0x224/0x380
  em28xx_v4l2_init+0x1d90/0x3770
 The buggy address belongs to the object at ffff8000d7ca2000
  which belongs to the cache kmalloc-2k of size 2048
 The buggy address is located 776 bytes inside of
  2048-byte region [ffff8000d7ca2000, ffff8000d7ca2800)
 The buggy address belongs to the page:
 page:ffff7fe00035f280 count:1 mapcount:0 mapping:ffff8000c001f000 index:0x0
 flags: 0x7ff800000000100(slab)
 raw: 07ff800000000100 ffff7fe00049d880 0000000300000003 ffff8000c001f000
 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
 page dumped because: kasan: bad access detected
 Memory state around the buggy address:
  ffff8000d7ca2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8000d7ca2280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 >ffff8000d7ca2300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                       ^
  ffff8000d7ca2380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8000d7ca2400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ==================================================================
[2] Actually, it is allocated for struct tuner, and dvb_frontend is inside.
[
    {
        "id": "CVE-2024-43900-33e5840e",
        "target": {
            "function": "load_firmware_cb",
            "file": "drivers/media/tuners/xc2028.c"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@850304152d367f104d21c77cfbcc05806504218b",
        "digest": {
            "function_hash": "117912859508577820136303520257427264566",
            "length": 436.0
        },
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "id": "CVE-2024-43900-488e427d",
        "target": {
            "file": "drivers/media/tuners/xc2028.c"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@850304152d367f104d21c77cfbcc05806504218b",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "305287264712382817597043167200654257946",
                "55111592443686806655732474776938529564",
                "24988514737844541599717608180021133888",
                "92078161676563474709177228456557848545",
                "270734994264940163238822677925291748961"
            ]
        },
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "id": "CVE-2024-43900-75c52c2e",
        "target": {
            "function": "load_firmware_cb",
            "file": "drivers/media/tuners/xc2028.c"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@208deb6d8c3cb8c3acb1f41eb31cf68ea08726d5",
        "digest": {
            "function_hash": "117912859508577820136303520257427264566",
            "length": 436.0
        },
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "id": "CVE-2024-43900-85ff3b80",
        "target": {
            "file": "drivers/media/tuners/xc2028.c"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef517bdfc01818419f7bd426969a0c86b14f3e0e",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "305287264712382817597043167200654257946",
                "55111592443686806655732474776938529564",
                "24988514737844541599717608180021133888",
                "92078161676563474709177228456557848545",
                "270734994264940163238822677925291748961"
            ]
        },
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "id": "CVE-2024-43900-b655b843",
        "target": {
            "file": "drivers/media/tuners/xc2028.c"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@208deb6d8c3cb8c3acb1f41eb31cf68ea08726d5",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "305287264712382817597043167200654257946",
                "55111592443686806655732474776938529564",
                "24988514737844541599717608180021133888",
                "92078161676563474709177228456557848545",
                "270734994264940163238822677925291748961"
            ]
        },
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "id": "CVE-2024-43900-dc436af3",
        "target": {
            "function": "load_firmware_cb",
            "file": "drivers/media/tuners/xc2028.c"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68594cec291ff9523b9feb3f43fd853dcddd1f60",
        "digest": {
            "function_hash": "117912859508577820136303520257427264566",
            "length": 436.0
        },
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "id": "CVE-2024-43900-eb0c164b",
        "target": {
            "function": "load_firmware_cb",
            "file": "drivers/media/tuners/xc2028.c"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef517bdfc01818419f7bd426969a0c86b14f3e0e",
        "digest": {
            "function_hash": "117912859508577820136303520257427264566",
            "length": 436.0
        },
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "id": "CVE-2024-43900-f1137a87",
        "target": {
            "file": "drivers/media/tuners/xc2028.c"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68594cec291ff9523b9feb3f43fd853dcddd1f60",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "305287264712382817597043167200654257946",
                "55111592443686806655732474776938529564",
                "24988514737844541599717608180021133888",
                "92078161676563474709177228456557848545",
                "270734994264940163238822677925291748961"
            ]
        },
        "deprecated": false,
        "signature_type": "Line"
    }
]