[v1] KASAN: slab-use-after-free Read in atkbd_set_repeat_rate

[syzbot] [input?] KASAN: slab-use-after-free Read in atkbd_set_repeat_rate

Posted by Jeffin Philip 4 weeks, 1 day ago

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 818bebeb63dd

diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index 5736f4bc5a50..056aa98f13e2 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -706,6 +706,7 @@ static inline void atkbd_enable(struct atkbd *atkbd)
 
 static inline void atkbd_disable(struct atkbd *atkbd)
 {
+	guard(mutex)(atkbd->mutex);
 	guard(serio_pause_rx)(atkbd->ps2dev.serio);
 
 	atkbd->enabled = false;

Re: [syzbot] [input?] KASAN: slab-use-after-free Read in atkbd_set_repeat_rate

Posted by syzbot 4 weeks, 1 day ago

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

drivers/input/keyboard/atkbd.c:709:27: error: incompatible type for argument 1 of 'class_mutex_constructor'
drivers/input/keyboard/atkbd.c:709:9: error: aggregate value used where an integer was expected


Tested on:

commit:         818bebeb drm/xe: Don't hand out the flat CCS storage a..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel config:  https://syzkaller.appspot.com/x/.config?x=ccca94d2c01b9e78
dashboard link: https://syzkaller.appspot.com/bug?extid=1e2ef9bcb29af666b2e6
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch:          https://syzkaller.appspot.com/x/patch.diff?x=107bdd49580000