Re: [PATCH v2] input: lkkbd: disable pending work before freeing device

[Dmitry Torokhov]

On Fri, Dec 12, 2025 at 02:23:14PM +0900, Minseong Kim wrote:
> lkkbd_interrupt() schedules lk->tq via schedule_work(), and the work
> handler lkkbd_reinit() dereferences the lkkbd structure and its
> serio/input_dev fields.
> 
> lkkbd_disconnect() and error paths in lkkbd_connect() free the lkkbd
> structure without preventing the reinit work from being queued again
> until serio_close() returns. This can allow the work handler to run
> after the structure has been freed, leading to a potential use-after-free.
> 
> Use disable_work_sync() instead of cancel_work_sync() to ensure the
> reinit work cannot be re-queued, and call it both in lkkbd_disconnect()
> and in lkkbd_connect() error paths after serio_open().
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Minseong Kim <ii4gsp@xxxxxxxxx>

Applied, thank you.

-- 
Dmitry