Re: [PATCH v4] Input: atkbd - fix uaf in atkbd_set_repeat_rate

From: Jeffin Philip

Date: Sun Aug 30 2026 - 04:15:34 EST


On Sat, 29 Aug 2026 09:34:48 -0700, Dmitry Torokhov wrote:
>Actually I think I was wrong and Sashiko was right. I will probably pick
>your v3 but I do not like that we do not clean up/reset LEDs properly
>on disconnect.

Would cleaning up leds cause any weird issues on reconnect? We could reset
LEDs though. Compiled only, but this?

diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index 41a0d55dae0e..3d0e58be5ba2 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -963,13 +963,16 @@ static void atkbd_disconnect(struct serio *serio)

atkbd_disable(atkbd);

- input_unregister_device(atkbd->dev);
-
/*
* Prevent work from being rescheduled after atkbd is marked disabled
*/
disable_delayed_work_sync(&atkbd->event_work);

+ if (atkbd->write)
+ atkbd_set_leds(atkbd);
+
+ input_unregister_device(atkbd->dev);
+
serio_close(serio);
serio_set_drvdata(serio, NULL);
kfree(atkbd);

Thanks,
Jeffin.