Re: test HID UAF

Re: test HID UAF

[syzbot]

> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

This crash does not have a reproducer. I cannot test it.

> master
> From aef1e103488c6a668bea9ba9e74e27a75c0be4b3 Mon Sep 17 00:00:00 2001
> From: Hyeonsu Choi <chlgustn3171@gmail.com>
> Date: Tue, 14 Jul 2026 18:50:00 +0900
> Subject: [PATCH] HID: input: allocate input_dev name/phys/uniq using
> hid device devres
>
> input_dev->name, phys, and uniq are directly assigned from hid_device.
> It causes a slab-use-after-free bug if the input device outlives the
> parent HID device during teardown.
> Fix this by using devm_kstrdup() tied to &hid->dev for name, phys, and
> uniq strings.
> The string lifetime is tied to the parent HID device, preventing a
> potential slab-use-after-free bug.
> Also add OOM error handling for these allocations.
>
> Reported-by: syzbot+aec1962419768c5caf88@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=aec1962419768c5caf88
> Signed-off-by: Hyeonsu Choi <chlgustn3171@gmail.com>
> ---
>  drivers/hid/hid-input.c | 19 ++++++++++++++++---
>  1 file changed, 16 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
> index 3487600cadb4..da6b338f18ba 100644
> --- a/drivers/hid/hid-input.c
> +++ b/drivers/hid/hid-input.c
> @@ -2125,10 +2125,21 @@ static struct hid_input
> *hidinput_allocate(struct hid_device *hid,
>         input_dev->close = hidinput_close;
>         input_dev->setkeycode = hidinput_setkeycode;
>         input_dev->getkeycode = hidinput_getkeycode;
> +
> +       const char *name = hidinput->name ? hidinput->name : hid->name;
> +
> +       input_dev->name = devm_kstrdup(&hid->dev, name, GFP_KERNEL);
> +       if (!input_dev->name)
> +               goto fail;
> +
> +       input_dev->phys = devm_kstrdup(&hid->dev, hid->phys, GFP_KERNEL);
> +       if (!input_dev->phys)
> +               goto fail;
> +
> +       input_dev->uniq = devm_kstrdup(&hid->dev, hid->uniq, GFP_KERNEL);
> +       if (!input_dev->uniq)
> +               goto fail;
>
> -       input_dev->name = hidinput->name ? hidinput->name : hid->name;
> -       input_dev->phys = hid->phys;
> -       input_dev->uniq = hid->uniq;
>         input_dev->id.bustype = hid->bus;
>         input_dev->id.vendor  = hid->vendor;
>         input_dev->id.product = hid->product;
> @@ -2144,6 +2155,8 @@ static struct hid_input
> *hidinput_allocate(struct hid_device *hid,
>         return hidinput;
>
>  fail:
> +       if (hidinput)
> +                kfree(hidinput->name);
>         kfree(hidinput);
>         input_free_device(input_dev);
>         hid_err(hid, "Out of memory during hid input probe\n");
> --
> 2.53.0