[syzbot] [input?] KASAN: slab-use-after-free Read in atkbd_set_repeat_rate

From: Jeffin Philip

Date: Fri Aug 28 2026 - 09:42:36 EST


#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 818bebeb63dd

diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index 5736f4bc5a50..e235038afec6 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -694,6 +694,7 @@ static int atkbd_event(struct input_dev *dev,

static inline void atkbd_enable(struct atkbd *atkbd)
{
+ guard(mutex)(&atkbd->mutex);
guard(serio_pause_rx)(atkbd->ps2dev.serio);

atkbd->enabled = true;
@@ -706,6 +707,7 @@ static inline void atkbd_enable(struct atkbd *atkbd)

static inline void atkbd_disable(struct atkbd *atkbd)
{
+ guard(mutex)(&atkbd->mutex);
guard(serio_pause_rx)(atkbd->ps2dev.serio);

atkbd->enabled = false;