From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out162-62-57-137.mail.qq.com (out162-62-57-137.mail.qq.com [162.62.57.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9078B3C1996 for ; Mon, 27 Apr 2026 13:12:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.62.57.137 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777295558; cv=none; b=DTbXH3+j+ci2jGUVW4XY+dodkh7uQsTlcZaf8r8vUNva7AgwcyxcToLlNBzBv0a4tJBOtgyDfeAhOWmn/pCtc0hKaGXYpIBsD2TNeANd5XuoD7g0dvPCaoq2A0UyfCHNHmBsKEfwM2Kni/39megn8NP7mKsWkwztB8IUWP69BWc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777295558; c=relaxed/simple; bh=UsAZKdu/MVxbZBUggYF8nRNEeF/EMKg/p9OspRsY7BU=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=RpJsxMiXAv/hfJuwE4X/et6xSAWQWgMUg2kSoDHTyMjrh/nyDUEosJ34KkmPHvOfx0rxYtboU14sQSDafQrwSxdsAO/bpRXQuOhCDJJxfRq+XkzBlLe66IYjUh7d8Jx8tK1CIo7xe4R50g7oAfKt9bys+VvXyaGi57yJfvw0IZc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=kb10gAT+; arc=none smtp.client-ip=162.62.57.137 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="kb10gAT+" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1777295551; bh=t0X2InkYO9m8zOeJbuR7TVlYJ2dqXk80rx/0bCFV80Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=kb10gAT+msD5xbcLfd1xEBvrs5MrysY+Ief2D7ub4l2Ze3bkUPntwPLV2ggqbn/4w iEC1noiL4w4NzP5+b8kufB0yTF4PD3Gnk3EV2O1D/tBn9q/6x7lWm7t5bXf55Lrlzn WFBts8G7yDROvanl1wT3OAuGiaFK7h6vPLAuoxhI= Received: from lxu-ped-host.. ([111.198.231.89]) by newxmesmtplogicsvrszb51-0.qq.com (NewEsmtp) with SMTP id 2D60C0AA; Mon, 27 Apr 2026 21:11:22 +0800 X-QQ-mid: xmsmtpt1777295482th2rcs96f Message-ID: X-QQ-XMAILINFO: NnYhxYSyuBnLftmDZm3FaHY7pyqE8RpmLvigzDZ+NaiPEuCctOHJnskLEAf59h WuHSuniMbayoLvT81xU7FPxw/d2jTR6qfb1zX/IoZqsVaYXdXxbF8venTJfrr1onf9m4TtjOOBK5 Eq4B96fUgHpelb9BeGH4ZWN/WWy95+8Anldt9d0rI9lPMtqfZ2MxGcLAIaerw7n6golcAI06PxJ4 dn94McPD45n3KNF5d3OyJD8NpuAdGAucfvA6mjPno7tNBJZYYo91PNUhFch0L86FZ3Om7BTR7OP7 1c/ddxIBoAx3a1Cl+t7wslPof2rCvsrjdxtFD3jhJ5+kmuFiCSECiZR0Ew9N1slLuUsv7C7QVBDG CWGh2ZW1FaLZe35gHSS/ymvwavTITSRfmVdKd2otMQN0VxGZ/WfXDpkRc5U6pysxlVwwIXERIMnd jv68vk+Y6pWFaryd1oRhME0TA6kkTSJDMWEmBbppTFEMpupQ4rIA/Eta8hoJIJql5ispnRQBXBeE bY3ebetjywpmFJGkIdFSfctXazeC6qStzLoqDLIAYbPA3jCobA5ubIK9RUiz0ZMPgz6auNECIwQx bWbUb4AcFJKEjqa+rojzwmU+IFbOHXKlsgyiyQBco0JAd7alk0HCdwQXH/AFmC8JjP5VG5DcVVz4 zZidH/4e30gCUZk11V4lzmgDc1v1VqZinHYdksdKhl2hIvpoLrLC0aaqJVs7ZmGRpxUNklbXbhWY YzTqYhwHyJEW/l6jygoo8FYhlAp26r8txKKeJhEdpAs4w7n3HmH0OjkAGYKKIpFBh4s5nwBb2JxM 1pC6qLpXQjRRm8GoJzTnbIldDtEq+1nB6GUZfLfddT/JwVVl6amIS3IQenW4g/kGcTa7Uj2GPAYu TzeCsYESFzqdC8XD8W9+i50ml92bEIs+CYquJbva8N2qUJGw2WydN0kF1oFbhHX5wnRbGNpC4+LR /E+I945rdVBwhtsXpdljtCDVhh42HgK5KIKelUHZ6evyzwzNYBmZNQyOIxsEXaux9Z25QsOoDm0T cljaMgghawywM6T8MY X-QQ-XMRINFO: Mp0Kj//9VHAxzExpfF+O8yhSrljjwrznVg== From: Edward Adam Davis To: syzbot+9eebf5f6544c5e873858@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [input?] [usb?] KASAN: slab-use-after-free Read in hidraw_report_event Date: Mon, 27 Apr 2026 21:11:22 +0800 X-OQ-MSGID: <20260427131121.213643-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <69eed7e0.a00a0220.7773.0026.GAE@google.com> References: <69eed7e0.a00a0220.7773.0026.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index 0b588e002834..a688f5edf9fb 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -2144,12 +2144,18 @@ static int __hid_input_report(struct hid_device *hid, enum hid_report_type type, } if (hdrv && hdrv->raw_event && hid_match_report(hid, report)) { + printk("before psu raw event, hid: %p claimed: %u, size: %u, " + "data: %p, lk (%p) cnt: %u, %s\n", hid, hid->claimed, size, data, + &hid->driver_input_lock, + hid->driver_input_lock.count, + __func__); ret = hdrv->raw_event(hid, report, data, size); if (ret < 0) goto unlock; } ret = hid_report_raw_event(hid, type, data, size, interrupt); + printk("after report raw event, hid: %p, ret: %d, %s\n", hid, ret, __func__); unlock: if (!lock_already_taken) @@ -2818,8 +2824,15 @@ static int hid_device_probe(struct device *dev) hdev->io_started = false; clear_bit(ffs(HID_STAT_REPROBED), &hdev->status); - if (!hdev->driver) + if (!hdev->driver) { + printk("before hid dev probe, hid: %p claimed: %u, lk (%p) cnt: %u, %s\n", + hdev, hdev->claimed, + &hdev->driver_input_lock, + hdev->driver_input_lock.count, + __func__); ret = __hid_device_probe(hdev, hdrv); + printk("after hid dev probe, hid: %p claimed: %u, ret: %d, %s\n", hdev, hdev->claimed, ret, __func__); + } if (!hdev->io_started) up(&hdev->driver_input_lock); @@ -3002,6 +3015,11 @@ struct hid_device *hid_allocate_device(void) INIT_LIST_HEAD(&hdev->debug_list); spin_lock_init(&hdev->debug_list_lock); sema_init(&hdev->driver_input_lock, 1); + printk("before psu raw event, hid: %p claimed: %u, " + "lk (%p) cnt: %u, %s\n", hdev, hdev->claimed, + &hdev->driver_input_lock, + hdev->driver_input_lock.count, + __func__); mutex_init(&hdev->ll_open_lock); kref_init(&hdev->ref);