Re: [syzbot] [input?] KASAN: slab-use-after-free Read in atkbd_set_repeat_rate

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Unconditional acquisition of `atkbd->mutex` in `atkbd_disable()` causes an AA self-deadlock because callers already hold this mutex.
- [Low] Passing `struct mutex` by value instead of a pointer to the `guard(mutex)` macro causes a build failure.
--

commit ea5b33bff452dfd0c6a1ded0647c9fed571513f0
Author: Jeffin Philip <jeffinphilip14@gmail.com>

    KASAN: slab-use-after-free Read in atkbd_set_repeat_rate

This commit adds a mutex guard to atkbd_disable() to prevent a
use-after-free issue detected by KASAN in atkbd_set_repeat_rate.
A syzkaller test case is referenced in the commit message.

> diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
> index 3509b58e64920..82157782e166f 100644
> --- a/drivers/input/keyboard/atkbd.c
> +++ b/drivers/input/keyboard/atkbd.c
> @@ -706,6 +706,7 @@ static inline void atkbd_enable(struct atkbd *atkbd)
>  
>  static inline void atkbd_disable(struct atkbd *atkbd)
>  {
> +	guard(mutex)(atkbd->mutex);

[Severity: Low]
Does this compile? The guard(mutex) macro expects a pointer to the mutex,
but it looks like we are passing the struct by value here instead of using
the address-of operator (&atkbd->mutex).

[Severity: High]
Does acquiring the mutex here cause a self-deadlock?

Looking at atkbd_reconnect() and atkbd_attr_set_helper(), they already acquire
the mutex before calling atkbd_disable():

drivers/input/keyboard/atkbd.c:atkbd_reconnect() {
...
	guard(mutex)(&atkbd->mutex);

	atkbd_disable(atkbd);
...
}

drivers/input/keyboard/atkbd.c:atkbd_attr_set_helper() {
...
	scoped_guard(mutex_intr, &atkbd->mutex) {
		atkbd_disable(atkbd);
...
}

Since mutexes are not recursive, wouldn't unconditional acquisition here
cause a thread hang when a user modifies a sysfs attribute or triggers a
reconnect?

>  	guard(serio_pause_rx)(atkbd->ps2dev.serio);
>  
>  	atkbd->enabled = false;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260828125430.11470-1-jeffinphilip14@gmail.com?part=1