Re: [syzbot] [usb?] [input?] KASAN: slab-use-after-free Read in k90_record_led_work

[Oliver Neukum]

On 31.08.26 07:46, Jeffin Philip wrote:

> I believe there is a patch for this already[1], but it has not been merged
> yet. Was written just as the merge window for v7.3 opened, so might have
> been the reason for not being merged.
>
> [1]: https://lore.kernel.org/all/20260817072831.139954-1-ccc194101@xxxxxxx/

Looking at this patch the following sequence seems possible:

CPU A				CPU B

enter k90_brightness_set()

if (led->removed) [FALSE]
				Enter k90_cleanup_backlight()
				drvdata->backlight->removed = true; [TOO LATE]
				cancel_work_sync(&drvdata->backlight->work); [NOP]
schedule_work(&led->work); [THIS IS BAD]

Just cancelling the work is not enough.

	Regards
		Oliver