KASAN: slab-use-after-free Read in roccat_open

Jeffin Philip posted 1 patch 1 month ago
KASAN: slab-use-after-free Read in roccat_open
Posted by Jeffin Philip 1 month ago
#syz test: upstream 903c1cf6dff9

diff --git a/drivers/hid/hid-roccat.c b/drivers/hid/hid-roccat.c
index 4f15eb951039..505844890ed3 100644
--- a/drivers/hid/hid-roccat.c
+++ b/drivers/hid/hid-roccat.c
@@ -236,6 +236,7 @@ static int roccat_release(struct inode *inode, struct file *file)
                        hid_hw_close(device->hid);
                } else {
                        roccat_free_device(device);
+                       devices[minor] = NULL;
                }
        }
diff --git a/drivers/hid/hid-roccat.c b/drivers/hid/hid-roccat.c
index 505844890ed3..220666bdd13d 100644
--- a/drivers/hid/hid-roccat.c
+++ b/drivers/hid/hid-roccat.c
@@ -370,8 +370,11 @@ void roccat_disconnect(int minor)
 
        mutex_lock(&devices_lock);
        device = devices[minor];
+       if (!device) {
+               mutex_unlock(&devices_lock);
+               return;
+       }
        mutex_unlock(&devices_lock);
-
        device->exist = 0; /* TODO exist maybe not needed */
 
        device_destroy(device->dev->class, MKDEV(roccat_major, minor));
Re: [syzbot] [input?] [usb?] KASAN: slab-use-after-free Read in roccat_open
Posted by syzbot 1 month ago
Hello,

syzbot tried to test the proposed patch but the build/boot failed:

failed to apply patch:
error: corrupt patch at line 12



Tested on:

commit:         903c1cf6 Add linux-next specific files for 20260821
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel config:  https://syzkaller.appspot.com/x/.config?x=61cbaf6d30cb97db
dashboard link: https://syzkaller.appspot.com/bug?extid=d632e93ffcd1452bc61e
compiler:       
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1513b415580000