[v1] KASAN: slab-use-after-free Read in atkbd_set_repeat_rate

[syzbot] [input?] KASAN: slab-use-after-free Read in atkbd_set_repeat_rate

Posted by Jeffin Philip 4 weeks, 1 day ago

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 818bebeb63dd

diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index 5736f4bc5a50..e235038afec6 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -694,6 +694,7 @@ static int atkbd_event(struct input_dev *dev,
 
 static inline void atkbd_enable(struct atkbd *atkbd)
 {
+	guard(mutex)(&atkbd->mutex);
 	guard(serio_pause_rx)(atkbd->ps2dev.serio);
 
 	atkbd->enabled = true;
@@ -706,6 +707,7 @@ static inline void atkbd_enable(struct atkbd *atkbd)
 
 static inline void atkbd_disable(struct atkbd *atkbd)
 {
+	guard(mutex)(&atkbd->mutex);
 	guard(serio_pause_rx)(atkbd->ps2dev.serio);
 
 	atkbd->enabled = false;

Re: [syzbot] [input?] KASAN: slab-use-after-free Read in atkbd_set_repeat_rate

Posted by syzbot 4 weeks, 1 day ago

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+1e2ef9bcb29af666b2e6@syzkaller.appspotmail.com
Tested-by: syzbot+1e2ef9bcb29af666b2e6@syzkaller.appspotmail.com

Tested on:

commit:         818bebeb drm/xe: Don't hand out the flat CCS storage a..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=109cf625580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=ccca94d2c01b9e78
dashboard link: https://syzkaller.appspot.com/bug?extid=1e2ef9bcb29af666b2e6
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch:          https://syzkaller.appspot.com/x/patch.diff?x=138fdd49580000

Note: testing is done by a robot and is best-effort only.