Re: [BUG] KASAN: slab-use-after-free in dev_driver_string from chaoskey_release

[Johan Hovold]

On Mon, Jun 08, 2026 at 09:29:23AM -0400, Alan Stern wrote:

> You're partly right.  Both my original patch and yours ignored the fact 
> that the driver takes a reference to the interface structure.  That 
> reference isn't dropped until chaoskey_free() runs, so the only 
> debugging statements that need to be removed are the ones following 
> calls to chaoskey_free().

> Index: usb-devel/drivers/usb/misc/chaoskey.c
> ===================================================================
> --- usb-devel.orig/drivers/usb/misc/chaoskey.c
> +++ usb-devel/drivers/usb/misc/chaoskey.c
> @@ -248,7 +248,6 @@ static void chaoskey_disconnect(struct u
>  		mutex_unlock(&dev->lock);
>  
>  	mutex_unlock(&chaoskey_list_lock);
> -	usb_dbg(interface, "disconnect done");

There is no need to remove this one as driver core holds a reference to
the interface until after disconnect() returns.

>  }
>  
>  static int chaoskey_open(struct inode *inode, struct file *file)
> @@ -320,7 +319,6 @@ bail:
>  	mutex_unlock(&dev->lock);
>  destruction:
>  	mutex_unlock(&chaoskey_list_lock);
> -	usb_dbg(interface, "release success");
>  	return rv;
>  }

Johan