Re: [PATCH 4/4] Input: psmouse - use guard() for resource management

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Unbounded array write (buffer overflow) in `psmouse_receive_byte` due to unhandled `protocol_handler = NULL`.
--

--- Patch [4]: [PATCH 4/4] Input: psmouse - use guard() for resource management ---
commit 7e27c0c560cf8dcd06bedf52a084dc88e9bf3ed9
Author: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Input: psmouse - use guard() for resource management

Replace manual serialization with guard(mutex) and guard(serio_pause_rx)
where appropriate. This eliminates the need for explicit goto-based error
paths.

> diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
> index a9a110f2c860a..58b9b5dd7f085 100644
> --- a/drivers/input/mouse/psmouse-base.c
> +++ b/drivers/input/mouse/psmouse-base.c

[ ... ]

> @@ -1461,7 +1456,7 @@ static void psmouse_disconnect(struct serio *serio)
>  
>  	disable_work_sync(&psmouse->resync_work);
>  
> -	mutex_lock(&psmouse_mutex);
> +	guard(mutex)(&psmouse_mutex);
>  
>  	psmouse_set_state(psmouse, PSMOUSE_CMD_MODE);
>  

[Severity: Critical]
With the changes in the first patch of this series, psmouse_disconnect() sets
psmouse->state = PSMOUSE_CMD_MODE and sets psmouse->protocol_handler = NULL
before calling the vendor disconnect handler.

If a noisy or malicious PS/2 device (e.g., emulated by a BMC or USB adapter)
spams bytes during this driver unbind window, psmouse_receive_byte() will
place them into psmouse->packet[psmouse->pktcnt++] and call
psmouse_handle_byte().

Because protocol_handler is NULL, psmouse_handle_byte() immediately returns 0:

drivers/input/mouse/psmouse-base.c:psmouse_handle_byte() {
    ...
	/* protocol_handler is NULL when device is being disconnected */
	if (unlikely(!psmouse->protocol_handler))
		return 0;
    ...
}

Since pktcnt is never reset here, could this regression allow pktcnt to
continuously increment and overflow the 8-byte psmouse->packet[] array on
subsequent bytes, corrupting struct psmouse fields and adjacent memory?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727050803.1269941-1-dmitry.torokhov@gmail.com?part=4