Re: [syzbot] [input?] KASAN: slab-use-after-free Read in atkbd_set_repeat_rate
From: sashiko-bot@kernel.org
Date: 2026-08-28 13:13:52
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Unconditional acquisition of `atkbd->mutex` in `atkbd_disable()` causes an AA self-deadlock because callers already hold this mutex.
- [Low] Passing `struct mutex` by value instead of a pointer to the `guard(mutex)` macro causes a build failure.
--
commit ea5b33bff452dfd0c6a1ded0647c9fed571513f0
Author: Jeffin Philip [off-list ref]
KASAN: slab-use-after-free Read in atkbd_set_repeat_rate
This commit adds a mutex guard to atkbd_disable() to prevent a
use-after-free issue detected by KASAN in atkbd_set_repeat_rate.
A syzkaller test case is referenced in the commit message.
quoted hunk ↗ jump to hunk
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c index 3509b58e64920..82157782e166f 100644 --- a/drivers/input/keyboard/atkbd.c +++ b/drivers/input/keyboard/atkbd.c@@ -706,6 +706,7 @@ static inline void atkbd_enable(struct atkbd *atkbd) static inline void atkbd_disable(struct atkbd *atkbd) { + guard(mutex)(atkbd->mutex);
[Severity: Low]
Does this compile? The guard(mutex) macro expects a pointer to the mutex,
but it looks like we are passing the struct by value here instead of using
the address-of operator (&atkbd->mutex).
[Severity: High]
Does acquiring the mutex here cause a self-deadlock?
Looking at atkbd_reconnect() and atkbd_attr_set_helper(), they already acquire
the mutex before calling atkbd_disable():
drivers/input/keyboard/atkbd.c:atkbd_reconnect() {
...
guard(mutex)(&atkbd->mutex);
atkbd_disable(atkbd);
...
}
drivers/input/keyboard/atkbd.c:atkbd_attr_set_helper() {
...
scoped_guard(mutex_intr, &atkbd->mutex) {
atkbd_disable(atkbd);
...
}
Since mutexes are not recursive, wouldn't unconditional acquisition here
cause a thread hang when a user modifies a sysfs attribute or triggers a
reconnect?
guard(serio_pause_rx)(atkbd->ps2dev.serio); atkbd->enabled = false;
-- Sashiko AI review · https://sashiko.dev/#/patchset/20260828125430.11470-1-jeffinphilip14@gmail.com?part=1