Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in atkbd_event_work

[Edward Adam Davis]

From: Edward Aadm Davis <eadavis@xxxxxxxx>

#syz test: upstream 704340f1cd0d

diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index b9ad2381f885..7f102ff95af8 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -962,9 +962,6 @@ static void atkbd_disconnect(struct serio *serio)
 	struct atkbd *atkbd = atkbd_from_serio(serio);
 
 	atkbd_disable(atkbd);
-
-	input_unregister_device(atkbd->dev);
-
 	/*
 	 * Make sure we don't have a command in flight.
 	 * Note that since atkbd->enabled is false event work will keep
@@ -972,6 +969,7 @@ static void atkbd_disconnect(struct serio *serio)
 	 * accessing freed input device or serio port.
 	 */
 	cancel_delayed_work_sync(&atkbd->event_work);
+	input_unregister_device(atkbd->dev);
 
 	serio_close(serio);
 	serio_set_drvdata(serio, NULL);