[PATCH] HID: input: allocate input_dev name/phys/uniq using hid device devres
From: Hyeonsu Choi <hidden>
Date: 2026-07-14 12:01:12
Also in:
lkml
Subsystem:
hid core layer, the rest · Maintainers:
Jiri Kosina, Benjamin Tissoires, Linus Torvalds
input_dev->name, phys, and uniq are directly assigned from hid_device. It causes a slab-use-after-free bug if the input device outlives the parent HID device during teardown. Fix this by using devm_kstrdup() tied to &hid->dev for name, phys, and uniq strings. The string lifetime is tied to the parent HID device, preventing a potential slab-use-after-free bug. Also add OOM error handling for these allocations. Reported-by: syzbot+aec1962419768c5caf88@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=aec1962419768c5caf88 Signed-off-by: Hyeonsu Choi <redacted> --- drivers/hid/hid-input.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-)
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 3487600cadb4..da6b338f18ba 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c@@ -2125,10 +2125,21 @@ static struct hid_input *hidinput_allocate(struct hid_device *hid, input_dev->close = hidinput_close; input_dev->setkeycode = hidinput_setkeycode; input_dev->getkeycode = hidinput_getkeycode; + + const char *name = hidinput->name ? hidinput->name : hid->name; + + input_dev->name = devm_kstrdup(&hid->dev, name, GFP_KERNEL); + if (!input_dev->name) + goto fail; + + input_dev->phys = devm_kstrdup(&hid->dev, hid->phys, GFP_KERNEL); + if (!input_dev->phys) + goto fail; + + input_dev->uniq = devm_kstrdup(&hid->dev, hid->uniq, GFP_KERNEL); + if (!input_dev->uniq) + goto fail; - input_dev->name = hidinput->name ? hidinput->name : hid->name; - input_dev->phys = hid->phys; - input_dev->uniq = hid->uniq; input_dev->id.bustype = hid->bus; input_dev->id.vendor = hid->vendor; input_dev->id.product = hid->product;
@@ -2144,6 +2155,8 @@ static struct hid_input *hidinput_allocate(struct hid_device *hid, return hidinput; fail: + if (hidinput) + kfree(hidinput->name); kfree(hidinput); input_free_device(input_dev); hid_err(hid, "Out of memory during hid input probe\n");
--
2.53.0