Re: [PATCH v4] Input: atkbd - fix uaf in atkbd_set_repeat_rate

[Dmitry Torokhov <dmitry.torokhov@gmail.com>]

On Sat, Aug 29, 2026 at 07:29:59PM +0530, Jeffin Philip wrote:
> atkbd_disable() marks atkbd as disabled to prevent any work
> event to be executed, however this can race with atkbd_event_work().
> If a pending work passes the atkbd->enabled check and atkbd_disable()
> runs after in disconnect, it could dereference dev which is freed in
> disconnect following atkbd being marked disabled. Fix this by adding
> disable_delayed_work_sync() which drops all work events preventing
> any rescheduling after atkbd is marked disabled.
> 
> Reported-by: syzbot+1e2ef9bcb29af666b2e6@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=1e2ef9bcb29af666b2e6
> Fixes: 0ef7a26af127 ("Input: atkbd - fix canceling event_work in disconnect")
> Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
> ---
> Changelog:
>  - Changed in v4:
>      Changed location of disable_pending_work_sync() after input_unregister_device()
>    as per Dmitry's suggestion.

Actually I think I was wrong and Sashiko was right. I will probably pick
your v3 but I do not like that we do not clean up/reset LEDs properly
on disconnect. I will have to think about it some more...

Thanks.

-- 
Dmitry