Re: [PATCH v3] Input: atkbd - fix uaf in atkbd_set_repeat_rate

[Dmitry Torokhov]

Hi Jeffin,

On Fri, Aug 28, 2026 at 09:52:11PM +0530, Jeffin Philip wrote:
> atkbd_disable() marks atkbd as disabled to prevent any work
> event to be executed, however this can race with atkbd_event_work().
> If a pending work passes the atkbd->enabled check and atkbd_disable()
> runs after in disconnect, it could dereference dev which is freed in
> disconnect following atkbd being marked disabled. Fix this by adding
> disable_delayed_work_sync() which drops all work events preventing
> any rescheduling after atkbd is marked disabled.
> 
> Reported-by: syzbot+1e2ef9bcb29af666b2e6@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=1e2ef9bcb29af666b2e6
> Fixes: 0ef7a26af127 ("Input: atkbd - fix canceling event_work in disconnect")
> Signed-off-by: Jeffin Philip <jeffinphilip14@xxxxxxxxx>
> ---
> Changelog:
>  - Changes in v3:
>      Rewrote the patch to include disable_delayed_work_sync() as per
>    Dmitry's suggestion.
>  
>  - Changes in v2:
>      Added a check for atkbd->enabled so userspace cannot queue events after
>    atkbd_disable.
> ---
>  drivers/input/keyboard/atkbd.c | 11 ++++-------
>  1 file changed, 4 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
> index 5736f4bc5a50..a92a04c005aa 100644
> --- a/drivers/input/keyboard/atkbd.c
> +++ b/drivers/input/keyboard/atkbd.c
> @@ -963,15 +963,12 @@ static void atkbd_disconnect(struct serio *serio)
>  
>  	atkbd_disable(atkbd);
>  
> -	input_unregister_device(atkbd->dev);
> -
>  	/*
> -	 * Make sure we don't have a command in flight.
> -	 * Note that since atkbd->enabled is false event work will keep
> -	 * rescheduling itself until it gets canceled and will not try
> -	 * accessing freed input device or serio port.
> +	 * Prevent work from being rescheduled after atkbd is marked disabled
>  	 */
> -	cancel_delayed_work_sync(&atkbd->event_work);
> +	disable_delayed_work_sync(&atkbd->event_work);
> +
> +	input_unregister_device(atkbd->dev);

There is no need to move the call to input_unregister_device(). When
atkbd->disabled is true the work handler will not attempt to access
input device or serio structures. The only change that is needed is
replacing cancel_delayed_work_sync with disable_delayed_work_sync.

Thanks.

-- 
Dmitry