Re: [syzbot] [usb?] [input?] KASAN: slab-use-after-free Read in k90_record_led_work

[Jeffin Philip <jeffinphilip14@gmail.com>]

On Wed, 2 Sep 2026 14:09:35 +0200, Oliver Neukum wrote:
>On 31.08.26 07:46, Jeffin Philip wrote:
>
>> I believe there is a patch for this already[1], but it has not been merged
>> yet. Was written just as the merge window for v7.3 opened, so might have
>> been the reason for not being merged.
>> 
>> [1]: https://lore.kernel.org/all/20260817072831.139954-1-ccc194101@163.com/
>
>Looking at this patch the following sequence seems possible:
>
>CPU A				CPU B
>
>enter k90_brightness_set()
>
>if (led->removed) [FALSE]
>				Enter k90_cleanup_backlight()
>				drvdata->backlight->removed = true; [TOO LATE]
>				cancel_work_sync(&drvdata->backlight->work); [NOP]
>schedule_work(&led->work); [THIS IS BAD]
>
>Just cancelling the work is not enough.

Hmm, we are in cleanup path, so wouldn't it be more sensible to use disable_work_sync
rather than cancel_work_sync to prevent this kind of issue?

Thanks,
Jeffin.