From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ot1-f71.google.com (mail-ot1-f71.google.com [209.85.210.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 04EBA3B1EF1 for ; Tue, 14 Jul 2026 11:48:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.71 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784029697; cv=none; b=JFfYM2nmYhPSPUXusy1LQeDScfYZKpcFSCnhieUvqmX1xtqe65kIuvzuHrpOCKTWDIneRkVHRb549fP1aHGvgIIgqEBCLIPcFleRv25ydpS/eT1OXp2mS850taQuUUFDm5BzVFGvz1CsJZvQhGW3V+DGgnh/DSgnMWcOeFdYGps= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784029697; c=relaxed/simple; bh=7HUWkzT5qEVrrFTfoiaif9W05wn+/7jnq5yLYGtSJgg=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To:Cc: Content-Type; b=jj+rtlymQJYVlsKbDlXiowANFDOLqDguPzpNiYzUqQ6mA8Wj5KewPBwK6ZG43DkhvE5u16xSqVMSBWdKlMBAOIHb+Qn9MPJtRW7QZlWaWX4PL9YQmZfLcpybdccR5JaDgNDnUqW/c7YzJLOp1li/TKqxW/0dwJdCLTyfkJX899g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.210.71 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-ot1-f71.google.com with SMTP id 46e09a7af769-7e99ff505c2so3569143a34.1 for ; Tue, 14 Jul 2026 04:48:15 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784029695; x=1784634495; h=content-type:cc:to:from:subject:message-id:in-reply-to:date :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=yz6ghq0uKpeMi8r7NYRSwVwRXpRyr0dmmqdzddZHQ10=; b=fvLxCQbjvZRj9nUPiZWMpWflL8V5IMuXxTww7/tAPf++UaWC2z07UahtVuJRRlCNKV D31TQAJYoPJ/lpoKMwTKrvaoK0jNTeuxTrUtPKdYofHg/XlCD9a+4qG/zpAEqB0EB6B0 ACeAIS8Kanuq0YdQrAvxEShmB8QyKYPhHQaM4DwRhmHq6Qz+PubsLaSWr0uAtmLkqpKH 8QZiJwECp/JE4hRuPGR5zs1rc0zS8bBFDZFpopd1lB9gqAoW5dLyBjFbUQlowlbuLWb8 tvjQZ/pGSXg4o9s+Z3LhTkhebBShSHogkmvE1Zl3HveditUEfryMyh6bXjXr5uLwQSiX 7FaQ== X-Forwarded-Encrypted: i=1; AFNElJ8ErpayuvvITe9yqb19eKrpDUa2jt4C4s7rbk6wSY4TJ9lFBqPCNDgm0wuPNJcKr+BBdkmphV55J5/IgN4=@vger.kernel.org X-Gm-Message-State: AOJu0Yx6rFMQz2MuM29z6qz/MxksuSWEgDjeG0YwWaK7bMPxPPW2DdFW vCCa+Fk8r/sE7hwJCqtY2XHMyuadAxsLgwkM0eFL9fagoBUNKFF8SyGq3BmOMgIx1Z+jCXfQGq0 72eS8CVaQgj3HpH209l1cp1yzzICrazfumLK8dPtgJ7p7mGi5nIGgVr8UovM= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:1350:b0:6a3:c6f8:4c9d with SMTP id 006d021491bc7-6a3cba99caamr1092853eaf.68.1784029694915; Tue, 14 Jul 2026 04:48:14 -0700 (PDT) Date: Tue, 14 Jul 2026 04:48:14 -0700 In-Reply-To: X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6a5621fe.c90005c7.37d349.0022.GAE@google.com> Subject: Re: test HID UAF From: syzbot To: chlgustn3171@gmail.com Cc: chlgustn3171@gmail.com, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" > #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git This crash does not have a reproducer. I cannot test it. > master > From aef1e103488c6a668bea9ba9e74e27a75c0be4b3 Mon Sep 17 00:00:00 2001 > From: Hyeonsu Choi > Date: Tue, 14 Jul 2026 18:50:00 +0900 > Subject: [PATCH] HID: input: allocate input_dev name/phys/uniq using > hid device devres > > input_dev->name, phys, and uniq are directly assigned from hid_device. > It causes a slab-use-after-free bug if the input device outlives the > parent HID device during teardown. > Fix this by using devm_kstrdup() tied to &hid->dev for name, phys, and > uniq strings. > The string lifetime is tied to the parent HID device, preventing a > potential slab-use-after-free bug. > Also add OOM error handling for these allocations. > > Reported-by: syzbot+aec1962419768c5caf88@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=aec1962419768c5caf88 > Signed-off-by: Hyeonsu Choi > --- > drivers/hid/hid-input.c | 19 ++++++++++++++++--- > 1 file changed, 16 insertions(+), 3 deletions(-) > > diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c > index 3487600cadb4..da6b338f18ba 100644 > --- a/drivers/hid/hid-input.c > +++ b/drivers/hid/hid-input.c > @@ -2125,10 +2125,21 @@ static struct hid_input > *hidinput_allocate(struct hid_device *hid, > input_dev->close = hidinput_close; > input_dev->setkeycode = hidinput_setkeycode; > input_dev->getkeycode = hidinput_getkeycode; > + > + const char *name = hidinput->name ? hidinput->name : hid->name; > + > + input_dev->name = devm_kstrdup(&hid->dev, name, GFP_KERNEL); > + if (!input_dev->name) > + goto fail; > + > + input_dev->phys = devm_kstrdup(&hid->dev, hid->phys, GFP_KERNEL); > + if (!input_dev->phys) > + goto fail; > + > + input_dev->uniq = devm_kstrdup(&hid->dev, hid->uniq, GFP_KERNEL); > + if (!input_dev->uniq) > + goto fail; > > - input_dev->name = hidinput->name ? hidinput->name : hid->name; > - input_dev->phys = hid->phys; > - input_dev->uniq = hid->uniq; > input_dev->id.bustype = hid->bus; > input_dev->id.vendor = hid->vendor; > input_dev->id.product = hid->product; > @@ -2144,6 +2155,8 @@ static struct hid_input > *hidinput_allocate(struct hid_device *hid, > return hidinput; > > fail: > + if (hidinput) > + kfree(hidinput->name); > kfree(hidinput); > input_free_device(input_dev); > hid_err(hid, "Out of memory during hid input probe\n"); > -- > 2.53.0