Re: [PATCH v2] Input: atkbd - fix UAF in atkbd_set_repeat_rate() on disconnect

[Dmitry Torokhov]

Hi Jeffin,

On Fri, Aug 28, 2026 at 03:35:47PM +0530, Jeffin Philip wrote:
> Commit 0ef7a26af127 ("Input: atkbd - fix canceling event_work in disconnect")
> moved cancel_delayed_work_sync() after input_unregister_device() on
> the premise that events may arrive until input_unregister_device returns.
> 
> However, this created a UAF as work that may have passed the
> atkbd->enabled check in atkbd_event_work() may attempt to dereference dev
> which is freed in input_unregister_device(). Reverting the commit also
> does not solve the issue as events may still come through and pass the
> enabled check as atkbd_disable() and event_work() guard with different
> locks. Fix this by closing the hardware first using serio_close()
> and then unregistering to prevent work from executing after
> input_unregister_device(). serio_close() closes the device preventing
> work from arriving. Additionally add a check for atkbd->enabled in
> atkbd_event() to prevent userspace from queuing new events after
> atkbd_disable() sets atkbd->enabled to false.

I believe the proper fix is to replace cancel_delayed_work_sync() with
disable_delayed_work_sync() to prevent rescheduling due to atkbd being
marked as disabled.

Thanks.

-- 
Dmitry