KASAN: slab-use-after-free Read in roccat_open

From: Jeffin Philip

Date: Thu Aug 27 2026 - 05:25:51 EST


#syz test: upstream 903c1cf6dff9

diff --git a/drivers/hid/hid-roccat.c b/drivers/hid/hid-roccat.c
index 4f15eb951039..505844890ed3 100644
--- a/drivers/hid/hid-roccat.c
+++ b/drivers/hid/hid-roccat.c
@@ -236,6 +236,7 @@ static int roccat_release(struct inode *inode, struct file *file)
hid_hw_close(device->hid);
} else {
roccat_free_device(device);
+ devices[minor] = NULL;
}
}
diff --git a/drivers/hid/hid-roccat.c b/drivers/hid/hid-roccat.c
index 505844890ed3..220666bdd13d 100644
--- a/drivers/hid/hid-roccat.c
+++ b/drivers/hid/hid-roccat.c
@@ -370,8 +370,11 @@ void roccat_disconnect(int minor)

mutex_lock(&devices_lock);
device = devices[minor];
+ if (!device) {
+ mutex_unlock(&devices_lock);
+ return;
+ }
mutex_unlock(&devices_lock);
-
device->exist = 0; /* TODO exist maybe not needed */

device_destroy(device->dev->class, MKDEV(roccat_major, minor));