From: Jeffin Philip <jeffinphilip14@gmail.com>
To: oneukum@suse.com
Cc: jeffinphilip14@gmail.com, linux-input@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org,
syzbot+0b8bff5929865345b29e@syzkaller.appspotmail.com,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [usb?] [input?] KASAN: slab-use-after-free Read in k90_record_led_work
Date: Sat, 5 Sep 2026 14:22:46 +0530 [thread overview]
Message-ID: <20260905085246.11121-1-jeffinphilip14@gmail.com> (raw)
In-Reply-To: <c79e754b-2ef4-49f2-8bb4-60b36ab9a36d@suse.com>
On Wed, 2 Sep 2026 14:09:35 +0200, Oliver Neukum wrote:
>On 31.08.26 07:46, Jeffin Philip wrote:
>
>> I believe there is a patch for this already[1], but it has not been merged
>> yet. Was written just as the merge window for v7.3 opened, so might have
>> been the reason for not being merged.
>>
>> [1]: https://lore.kernel.org/all/20260817072831.139954-1-ccc194101@163.com/
>
>Looking at this patch the following sequence seems possible:
>
>CPU A CPU B
>
>enter k90_brightness_set()
>
>if (led->removed) [FALSE]
> Enter k90_cleanup_backlight()
> drvdata->backlight->removed = true; [TOO LATE]
> cancel_work_sync(&drvdata->backlight->work); [NOP]
>schedule_work(&led->work); [THIS IS BAD]
>
>Just cancelling the work is not enough.
Hmm, we are in cleanup path, so wouldn't it be more sensible to use disable_work_sync
rather than cancel_work_sync to prevent this kind of issue?
Thanks,
Jeffin.
prev parent reply other threads:[~2026-09-05 8:53 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-30 0:04 [syzbot] [usb?] [input?] KASAN: slab-use-after-free Read in k90_record_led_work syzbot
2026-08-31 5:46 ` Jeffin Philip
2026-09-02 12:09 ` Oliver Neukum
2026-09-05 8:52 ` Jeffin Philip [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260905085246.11121-1-jeffinphilip14@gmail.com \
--to=jeffinphilip14@gmail.com \
--cc=linux-input@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=oneukum@suse.com \
--cc=syzbot+0b8bff5929865345b29e@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.