* Forwarded: [PATCH] Input: sur40 - fix use-after-free in v4l2_release on disconnect
2026-09-11 16:15 [syzbot] [media?] KASAN: slab-use-after-free Read in v4l2_release (3) syzbot
@ 2026-09-12 1:03 ` syzbot
2026-09-14 11:46 ` Forwarded: [PATCH] KASAN: slab-use-after-free Read in v4l2_release (3) syzbot
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-09-12 1:03 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] Input: sur40 - fix use-after-free in v4l2_release on disconnect
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
sur40_disconnect() unconditionally freed the sur40_state struct
(which embeds struct video_device vdev) via kfree(), even while a
userspace process could still hold an open file descriptor on the
video device. video_unregister_device() does not wait for open file
descriptors to close before returning, so if a process closed its fd
after disconnect() had already run, v4l2_release() would dereference
the already-freed vdev, resulting in a slab-use-after-free.
Fix this by giving vdev a real .release callback (sur40_video_release)
instead of video_device_release_empty, and move the v4l2_device
unregister and the kfree() calls into it. This defers the actual free
until the last reference to vdev drops to zero, whether that happens
during disconnect() (no fd open) or later when the last open fd is
closed.
Reported-by: syzbot+34957180b0ed2581edaf@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=34957180b0ed2581edaf
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
drivers/input/touchscreen/sur40.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
index 09d8c5f8d09f..bd8d9f6190fb 100644
--- a/drivers/input/touchscreen/sur40.c
+++ b/drivers/input/touchscreen/sur40.c
@@ -179,6 +179,7 @@ static uint gain = SUR40_GAIN_DEF;
module_param(gain, uint, 0644);
MODULE_PARM_DESC(gain, "set initial gain"
SUR40_PARAM_RANGE(SUR40_GAIN_MIN, SUR40_GAIN_MAX));
+static void sur40_video_release(struct video_device *vdev);
static const struct v4l2_pix_format sur40_pix_format[] = {
{
@@ -750,6 +751,7 @@ static int sur40_probe(struct usb_interface *interface,
sur40->vdev.v4l2_dev = &sur40->v4l2;
sur40->vdev.lock = &sur40->lock;
sur40->vdev.queue = &sur40->queue;
+ sur40->vdev.release = sur40_video_release;
video_set_drvdata(&sur40->vdev, sur40);
/* initialize the control handler for 4 controls */
@@ -820,6 +822,16 @@ static int sur40_probe(struct usb_interface *interface,
return error;
}
+static void sur40_video_release(struct video_device *vdev)
+{
+ struct sur40_state *sur40 = container_of(
+ vdev,struct sur40_state , vdev);
+
+ v4l2_device_unregister(&sur40->v4l2);
+ kfree(sur40->bulk_in_buffer);
+ kfree(sur40);
+}
+
/* Unregister device & clean up. */
static void sur40_disconnect(struct usb_interface *interface)
{
@@ -829,10 +841,6 @@ static void sur40_disconnect(struct usb_interface *interface)
v4l2_ctrl_handler_free(&sur40->hdl);
video_unregister_device(&sur40->vdev);
- v4l2_device_unregister(&sur40->v4l2);
-
- kfree(sur40->bulk_in_buffer);
- kfree(sur40);
usb_set_intfdata(interface, NULL);
dev_dbg(&interface->dev, "%s is now disconnected\n", DRIVER_DESC);
--
2.43.0
^ permalink raw reply [flat|nested] 5+ messages in thread* Forwarded: [PATCH] KASAN: slab-use-after-free Read in v4l2_release (3)
2026-09-11 16:15 [syzbot] [media?] KASAN: slab-use-after-free Read in v4l2_release (3) syzbot
2026-09-12 1:03 ` Forwarded: [PATCH] Input: sur40 - fix use-after-free in v4l2_release on disconnect syzbot
@ 2026-09-14 11:46 ` syzbot
2026-09-15 1:38 ` syzbot
2026-09-17 1:26 ` syzbot
3 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-09-14 11:46 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: [PATCH] KASAN: slab-use-after-free Read in v4l2_release (3)
Author: jchuang26@m.fudan.edu.cn
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 08df884136f1c1197bab2a27814404fd329d9aac
Reported-by: syzbot+34957180b0ed2581edaf@syzkaller.appspotmail.com
diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
index 09d8c5f8d..4da6ad1c3 100644
--- a/drivers/input/touchscreen/sur40.c
+++ b/drivers/input/touchscreen/sur40.c
@@ -647,6 +647,24 @@ static int sur40_input_setup_events(struct input_dev *input_dev)
return 0;
}
+/*
+ * Final cleanup of the driver state. This runs through v4l2_device_put()
+ * once the last reference to the v4l2_device is gone, i.e. after
+ * video_unregister_device() and after every open file descriptor of the
+ * video node has been closed. Freeing sur40 earlier (for instance
+ * directly in sur40_disconnect()) would let v4l2_release() access the
+ * already freed video_device.
+ */
+static void sur40_v4l2_release(struct v4l2_device *v4l2_dev)
+{
+ struct sur40_state *sur40 = container_of(v4l2_dev, struct sur40_state, v4l2);
+
+ v4l2_device_unregister(&sur40->v4l2);
+ v4l2_ctrl_handler_free(&sur40->hdl);
+ kfree(sur40->bulk_in_buffer);
+ kfree(sur40);
+}
+
/* Check candidate USB interface. */
static int sur40_probe(struct usb_interface *interface,
const struct usb_device_id *id)
@@ -727,6 +745,7 @@ static int sur40_probe(struct usb_interface *interface,
/* register the video master device */
snprintf(sur40->v4l2.name, sizeof(sur40->v4l2.name), "%s", DRIVER_LONG);
+ sur40->v4l2.release = sur40_v4l2_release;
error = v4l2_device_register(sur40->dev, &sur40->v4l2);
if (error) {
dev_err(&interface->dev,
@@ -778,7 +797,6 @@ static int sur40_probe(struct usb_interface *interface,
if (sur40->hdl.error) {
dev_err(&interface->dev,
"Unable to register video controls.");
- v4l2_ctrl_handler_free(&sur40->hdl);
error = sur40->hdl.error;
goto err_unreg_v4l2;
}
@@ -787,7 +805,7 @@ static int sur40_probe(struct usb_interface *interface,
if (error) {
dev_err(&interface->dev,
"Unable to register video subdevice.");
- goto err_free_ctrl;
+ goto err_unreg_v4l2;
}
/* register the polled input device */
@@ -806,10 +824,17 @@ static int sur40_probe(struct usb_interface *interface,
err_unreg_video:
video_unregister_device(&sur40->vdev);
-err_free_ctrl:
- v4l2_ctrl_handler_free(&sur40->hdl);
err_unreg_v4l2:
- v4l2_device_unregister(&sur40->v4l2);
+ /*
+ * Drop the reference taken above by v4l2_device_register(). The
+ * last reference releases sur40 via sur40_v4l2_release(), which
+ * also frees the control handler and the bulk buffer.
+ */
+ input_free_device(input);
+ v4l2_device_put(&sur40->v4l2);
+
+ return error;
+
err_free_buffer:
kfree(sur40->bulk_in_buffer);
err_free_input:
@@ -827,15 +852,19 @@ static void sur40_disconnect(struct usb_interface *interface)
input_unregister_device(sur40->input);
- v4l2_ctrl_handler_free(&sur40->hdl);
video_unregister_device(&sur40->vdev);
v4l2_device_unregister(&sur40->v4l2);
- kfree(sur40->bulk_in_buffer);
- kfree(sur40);
-
usb_set_intfdata(interface, NULL);
dev_dbg(&interface->dev, "%s is now disconnected\n", DRIVER_DESC);
+
+ /*
+ * Release the reference taken by v4l2_device_register(). If the
+ * video node is still open, sur40_v4l2_release() is deferred until
+ * the last file descriptor is closed, so sur40 stays valid for
+ * v4l2_release().
+ */
+ v4l2_device_put(&sur40->v4l2);
}
/*
^ permalink raw reply [flat|nested] 5+ messages in thread* Forwarded: [PATCH] KASAN: slab-use-after-free Read in v4l2_release (3)
2026-09-11 16:15 [syzbot] [media?] KASAN: slab-use-after-free Read in v4l2_release (3) syzbot
2026-09-12 1:03 ` Forwarded: [PATCH] Input: sur40 - fix use-after-free in v4l2_release on disconnect syzbot
2026-09-14 11:46 ` Forwarded: [PATCH] KASAN: slab-use-after-free Read in v4l2_release (3) syzbot
@ 2026-09-15 1:38 ` syzbot
2026-09-17 1:26 ` syzbot
3 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-09-15 1:38 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: [PATCH] KASAN: slab-use-after-free Read in v4l2_release (3)
Author: jchuang26@m.fudan.edu.cn
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Reported-by: syzbot+34957180b0ed2581edaf@syzkaller.appspotmail.com
diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
index 09d8c5f8d..4da6ad1c3 100644
--- a/drivers/input/touchscreen/sur40.c
+++ b/drivers/input/touchscreen/sur40.c
@@ -647,6 +647,24 @@ static int sur40_input_setup_events(struct input_dev *input_dev)
return 0;
}
+/*
+ * Final cleanup of the driver state. This runs through v4l2_device_put()
+ * once the last reference to the v4l2_device is gone, i.e. after
+ * video_unregister_device() and after every open file descriptor of the
+ * video node has been closed. Freeing sur40 earlier (for instance
+ * directly in sur40_disconnect()) would let v4l2_release() access the
+ * already freed video_device.
+ */
+static void sur40_v4l2_release(struct v4l2_device *v4l2_dev)
+{
+ struct sur40_state *sur40 = container_of(v4l2_dev, struct sur40_state, v4l2);
+
+ v4l2_device_unregister(&sur40->v4l2);
+ v4l2_ctrl_handler_free(&sur40->hdl);
+ kfree(sur40->bulk_in_buffer);
+ kfree(sur40);
+}
+
/* Check candidate USB interface. */
static int sur40_probe(struct usb_interface *interface,
const struct usb_device_id *id)
@@ -727,6 +745,7 @@ static int sur40_probe(struct usb_interface *interface,
/* register the video master device */
snprintf(sur40->v4l2.name, sizeof(sur40->v4l2.name), "%s", DRIVER_LONG);
+ sur40->v4l2.release = sur40_v4l2_release;
error = v4l2_device_register(sur40->dev, &sur40->v4l2);
if (error) {
dev_err(&interface->dev,
@@ -778,7 +797,6 @@ static int sur40_probe(struct usb_interface *interface,
if (sur40->hdl.error) {
dev_err(&interface->dev,
"Unable to register video controls.");
- v4l2_ctrl_handler_free(&sur40->hdl);
error = sur40->hdl.error;
goto err_unreg_v4l2;
}
@@ -787,7 +805,7 @@ static int sur40_probe(struct usb_interface *interface,
if (error) {
dev_err(&interface->dev,
"Unable to register video subdevice.");
- goto err_free_ctrl;
+ goto err_unreg_v4l2;
}
/* register the polled input device */
@@ -806,10 +824,17 @@ static int sur40_probe(struct usb_interface *interface,
err_unreg_video:
video_unregister_device(&sur40->vdev);
-err_free_ctrl:
- v4l2_ctrl_handler_free(&sur40->hdl);
err_unreg_v4l2:
- v4l2_device_unregister(&sur40->v4l2);
+ /*
+ * Drop the reference taken above by v4l2_device_register(). The
+ * last reference releases sur40 via sur40_v4l2_release(), which
+ * also frees the control handler and the bulk buffer.
+ */
+ input_free_device(input);
+ v4l2_device_put(&sur40->v4l2);
+
+ return error;
+
err_free_buffer:
kfree(sur40->bulk_in_buffer);
err_free_input:
@@ -827,15 +852,19 @@ static void sur40_disconnect(struct usb_interface *interface)
input_unregister_device(sur40->input);
- v4l2_ctrl_handler_free(&sur40->hdl);
video_unregister_device(&sur40->vdev);
v4l2_device_unregister(&sur40->v4l2);
- kfree(sur40->bulk_in_buffer);
- kfree(sur40);
-
usb_set_intfdata(interface, NULL);
dev_dbg(&interface->dev, "%s is now disconnected\n", DRIVER_DESC);
+
+ /*
+ * Release the reference taken by v4l2_device_register(). If the
+ * video node is still open, sur40_v4l2_release() is deferred until
+ * the last file descriptor is closed, so sur40 stays valid for
+ * v4l2_release().
+ */
+ v4l2_device_put(&sur40->v4l2);
}
/*
^ permalink raw reply [flat|nested] 5+ messages in thread* Forwarded: [PATCH] KASAN: slab-use-after-free Read in v4l2_release (3)
2026-09-11 16:15 [syzbot] [media?] KASAN: slab-use-after-free Read in v4l2_release (3) syzbot
` (2 preceding siblings ...)
2026-09-15 1:38 ` syzbot
@ 2026-09-17 1:26 ` syzbot
3 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-09-17 1:26 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: [PATCH] KASAN: slab-use-after-free Read in v4l2_release (3)
Author: jchuang26@m.fudan.edu.cn
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Reported-by: syzbot+34957180b0ed2581edaf@syzkaller.appspotmail.com
diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
index 09d8c5f8d..39166161d 100644
--- a/drivers/input/touchscreen/sur40.c
+++ b/drivers/input/touchscreen/sur40.c
@@ -647,6 +647,25 @@ static int sur40_input_setup_events(struct input_dev *input_dev)
return 0;
}
+/*
+ * Release the sur40 state once the last reference to the video device is
+ * gone. The video_device is embedded in sur40, so sur40 must not be freed
+ * while an open file descriptor can still reach it (e.g. from the v4l2 core
+ * release path). sur40_disconnect() only drops the reference taken by
+ * v4l2_device_register(), which frees sur40 right away if nothing is open
+ * or defers it to this callback until the last user closes the device.
+ */
+static void sur40_release(struct v4l2_device *v4l2_dev)
+{
+ struct sur40_state *sur40 =
+ container_of(v4l2_dev, struct sur40_state, v4l2);
+
+ v4l2_ctrl_handler_free(&sur40->hdl);
+ v4l2_device_unregister(&sur40->v4l2);
+ kfree(sur40->bulk_in_buffer);
+ kfree(sur40);
+}
+
/* Check candidate USB interface. */
static int sur40_probe(struct usb_interface *interface,
const struct usb_device_id *id)
@@ -726,6 +745,7 @@ static int sur40_probe(struct usb_interface *interface,
}
/* register the video master device */
+ sur40->v4l2.release = sur40_release;
snprintf(sur40->v4l2.name, sizeof(sur40->v4l2.name), "%s", DRIVER_LONG);
error = v4l2_device_register(sur40->dev, &sur40->v4l2);
if (error) {
@@ -827,14 +847,18 @@ static void sur40_disconnect(struct usb_interface *interface)
input_unregister_device(sur40->input);
- v4l2_ctrl_handler_free(&sur40->hdl);
+ v4l2_device_disconnect(&sur40->v4l2);
video_unregister_device(&sur40->vdev);
- v4l2_device_unregister(&sur40->v4l2);
-
- kfree(sur40->bulk_in_buffer);
- kfree(sur40);
usb_set_intfdata(interface, NULL);
+
+ /*
+ * Drop the reference taken by v4l2_device_register(). The state is
+ * only freed from sur40_release() once the last video device user is
+ * gone, so an open device node cannot use the freed memory.
+ */
+ v4l2_device_put(&sur40->v4l2);
+
dev_dbg(&interface->dev, "%s is now disconnected\n", DRIVER_DESC);
}
^ permalink raw reply [flat|nested] 5+ messages in thread