Re: [syzbot] [usb?] [input?] KASAN: slab-use-after-free Read in k90_record_led_work

On Wed, 2 Sep 2026 14:09:35 +0200, Oliver Neukum wrote:

On 31.08.26 07:46, Jeffin Philip wrote:

quoted

I believe there is a patch for this already[1], but it has not been merged
yet. Was written just as the merge window for v7.3 opened, so might have
been the reason for not being merged.

[1]: https://lore.kernel.org/all/20260817072831.139954-1-ccc194101@163.com/ (local)

Looking at this patch the following sequence seems possible:

CPU A				CPU B

enter k90_brightness_set()

if (led->removed) [FALSE]
			Enter k90_cleanup_backlight()
			drvdata->backlight->removed = true; [TOO LATE]
			cancel_work_sync(&drvdata->backlight->work); [NOP]
schedule_work(&led->work); [THIS IS BAD]

Just cancelling the work is not enough.

Hmm, we are in cleanup path, so wouldn't it be more sensible to use disable_work_sync
rather than cancel_work_sync to prevent this kind of issue?

Thanks,
Jeffin.