[PATCH] Input: synaptics-rmi4 - fix input_dev->name use-after-free on unplug
From: Wei Jie Law
Date: Mon Aug 24 2026 - 23:13:40 EST
rmi_driver_probe() reuses the transport driver's input device when it has
one, and then renames it out of memory owned by the RMI device:
if (rmi_dev->xport->input) {
data->input = rmi_dev->xport->input;
...
name = devm_kasprintf(&rmi_dev->dev, GFP_KERNEL,
"Synaptics %s", device_name);
if (!name)
return;
input->name = name;
In the borrowed case the name outlives its allocation. hid-rmi is the
transport that hits it: rmi_input_configured() hands us its hidinput
device, and rmi_remove() then tears the RMI device down first:
rmi_unregister_transport_device(&hdata->xport);
hid_hw_stop(hdev);
The first line unbinds this driver, so devres frees the name. The second
reaches input_unregister_device(), whose device_del() emits the
KOBJ_REMOVE uevent, and input_dev_uevent() does
if (dev->name)
INPUT_ADD_HOTPLUG_VAR("NAME=\"%s\"", dev->name);
so vsnprintf() walks the freed string and copies it into the uevent that
is broadcast to userspace. With slub_debug=FZPU the remove event carries
NAME="kkkkkkkkkkkkkkkkkkkkkkk\xa5\xbb\xbb\xbb\xbb\xbb\xbb\xbb\xbb..."
i.e. POISON_FREE, POISON_END, the redzone and the SLUB tracking metadata
past the end of the object - the read runs to the first NUL, so it leaves
the object as well.
BUG: KASAN: slab-use-after-free in string+0x2a9/0x330
Read of size 1 at addr ffff88810a379d31 by task name/8056
[...]
string+0x2a9/0x330
vsnprintf+0x5ec/0x1680
add_uevent_var+0x165/0x390
input_dev_uevent+0x14c/0x750
dev_uevent+0x26e/0x6e0
kobject_uevent_env+0x4ed/0x11b0
device_del+0x5ac/0x940
input_unregister_device+0x88/0xc0
hidinput_disconnect+0x144/0x3e0
hid_disconnect+0xf7/0x160
hid_hw_stop+0x13/0x70
hid_device_remove+0xc4/0x220
[...]
Allocated by task 7810:
devm_kasprintf+0xb0/0xe0
rmi_driver_probe+0x3e0/0xbf0 [rmi_core]
rmi_register_transport_device+0x19e/0x3e0 [rmi_core]
rmi_input_configured+0x184/0x2e0 [hid_rmi]
Freed by task 8056:
release_nodes+0xf0/0x260
devres_release_all+0x106/0x170
device_unbind_cleanup+0x16/0x1a0
device_release_driver_internal+0x3f9/0x550
rmi_unregister_transport_device+0x34/0x50 [rmi_core]
rmi_remove+0xd0/0x100 [hid_rmi]
This is not limited to the RMI_DEVICE_HAS_PHYS_BUTTONS models: any RMI4
sensor reaches it, because rmi_init_functions() runs inside
rmi_input_configured() and F11/F12/F30 call input_set_capability() on the
borrowed device, so hidinput_connect() finds it populated and registers
it. 11 to 14 reports per three unplugs here.
The same string is read on the add side too.
rmi_register_transport_device() returns 0 whenever device_add() succeeded,
so a probe failure of this driver - rmi_enable_sensor() failing on a
register read is enough, and a HID device that stops answering can arrange
that - does not stop the transport: devres frees the name, and
hidinput_connect() then goes on to call input_register_device(), which
prints the name and emits KOBJ_ADD.
BUG: KASAN: slab-use-after-free in string+0x2a9/0x330
[...]
input_register_device+0x710/0xe10
hidinput_connect+0x1466/0x2a50
[...]
Freed by task 4394:
release_nodes+0xf0/0x260
devres_release_all+0x106/0x170
device_unbind_cleanup+0x16/0x1a0
really_probe+0x388/0x930
Moving the allocation onto the input device does not help - device_del()
releases devres before it emits the uevent - so put the name back to a
string with static storage duration when this driver lets go of an input
device it does not own, both on remove and on the probe error paths.
That means writing to the borrowed device after hidinput_connect() may
already have thrown it away: if none of the RMI functions populated it,
hidinput_connect() calls hidinput_cleanup_hidinput() and frees it while
data->input still points there. Take a reference for as long as we keep
the pointer, which also stops rmi_process_interrupt_requests() from
input_sync()ing a freed device.
Fixes: 2b6a321da9a2 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wei Jie Law <98lawweijie@xxxxxxxxx>
---
drivers/input/rmi4/rmi_driver.c | 23 ++++++++++++++++++++++-
1 file changed, 22 insertions(+), 1 deletion(-)
diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
index 5d49a9021c7d..8696a6aa0fa9 100644
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -369,6 +369,24 @@ static void rmi_driver_set_input_name(struct rmi_device *rmi_dev,
input->name = name;
}
+/*
+ * Let go of an input device that belongs to the transport driver. It outlives
+ * us, but rmi_driver_set_input_name() pointed its name at devres memory of
+ * ours that is freed as soon as we are done - input_register_device() and both
+ * the add and the remove uevent print that name - so put the name back to a
+ * string with static storage duration before dropping the reference.
+ */
+static void rmi_driver_put_input(struct rmi_device *rmi_dev,
+ struct rmi_driver_data *data)
+{
+ if (!data->input || data->input != rmi_dev->xport->input)
+ return;
+
+ data->input->name = SYNAPTICS_INPUT_DEVICE_NAME;
+ input_put_device(data->input);
+ data->input = NULL;
+}
+
static int rmi_driver_set_irq_bits(struct rmi_device *rmi_dev,
unsigned long *mask)
{
@@ -1026,6 +1044,8 @@ static int rmi_driver_remove(struct device *dev)
rmi_f34_remove_sysfs(rmi_dev);
rmi_free_function_list(rmi_dev);
+ rmi_driver_put_input(rmi_dev, data);
+
irq_domain_remove(data->irqdomain);
data->irqdomain = NULL;
@@ -1231,7 +1251,7 @@ static int rmi_driver_probe(struct device *dev)
* One example is some HID touchpads report "pass-through"
* button events are not reported by rmi registers.
*/
- data->input = rmi_dev->xport->input;
+ data->input = input_get_device(rmi_dev->xport->input);
} else {
data->input = devm_input_allocate_device(dev);
if (!data->input) {
@@ -1287,6 +1307,7 @@ static int rmi_driver_probe(struct device *dev)
err_destroy_functions:
rmi_free_function_list(rmi_dev);
err:
+ rmi_driver_put_input(rmi_dev, data);
return retval;
}
--
2.43.0