[PATCH RFC] Input: serio - check if device is registered in serio_find_driver()

[PATCH RFC] Input: serio - check if device is registered in serio_find_driver()

[syzbot]

A general protection fault can occur in __device_attach() due to a race
condition between serio_add_port() and serio_interrupt() when device_add()
fails.

If device_add() fails (e.g., due to a memory allocation failure), it cleans
up and sets dev->p = NULL. However, there is a brief window during
device_add() where kobject_add() sets state_in_sysfs = 1, causing
device_is_registered() to return true. If an interrupt occurs during this
window, serio_interrupt() might queue a SERIO_RESCAN_PORT event.

When the workqueue processes this stale event, it eventually calls
serio_find_driver(), which directly invokes device_attach() without
verifying if the device was successfully registered. This leads to a NULL
pointer dereference when __device_attach() attempts to lock the device
using the freed dev->p.

Oops: general protection fault, probably for non-canonical address
0xdffffc0000000021: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
CPU: 1 UID: 0 PID: 5689 Comm: kworker/1:4 Not tainted
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events_long serio_handle_event
RIP: 0010:__device_attach+0xb3/0x450 drivers/base/dd.c:1074
Call Trace:
 <TASK>
 serio_find_driver drivers/input/serio/serio.c:112 [inline]
 serio_handle_event+0x581/0x860 drivers/input/serio/serio.c:206
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0x92d/0xe10 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Fix this by checking if the device is registered in serio_find_driver()
before attempting to attach a driver, safely ignoring any stale events for
devices that failed registration.

Fixes: ddf1ffbd40c9 ("Input: serio - let device core tell us if device was registered")
Assisted-by: Gemini:gemini-3.6-flash Gemini:gemini-3.1-pro-preview syzbot
Reported-by: syzbot+de42beb9ccc760a210ab@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=de42beb9ccc760a210ab
Link: https://syzkaller.appspot.com/ai_job?id=4397f1ef-be0d-4e1b-897a-fcd37e50cc6b
To: "Dmitry Torokhov" <dmitry.torokhov@gmail.com>
To: <linux-input@vger.kernel.org>
Cc: "Kees Cook" <kees@kernel.org>
Cc: <linux-kernel@vger.kernel.org>

---
diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
index 54dd26249..c24e431af 100644
--- a/drivers/input/serio/serio.c
+++ b/drivers/input/serio/serio.c
@@ -109,6 +109,9 @@ static void serio_find_driver(struct serio *serio)
 {
 	int error;
 
+	if (!device_is_registered(&serio->dev))
+		return;
+
 	error = device_attach(&serio->dev);
 	if (error < 0 && error != -EPROBE_DEFER)
 		dev_warn(&serio->dev,


base-commit: db2ddb87143519e20a95aa36c60b36107b736a58
-- 
This is an AI-generated patch subject to moderation.
Reply with '#syz upstream' to Sign-off the patch as a human author
and send it to the upstream kernel mailing lists.
Reply with '#syz reject' to reject it ('#syz unreject' to undo).

See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
You can comment on the patch as usual, syzbot will try to address
the comments and send a new version of the patch if necessary.
syzbot engineers can be reached at syzkaller@googlegroups.com.

Re: [PATCH RFC] Input: serio - check if device is registered in serio_find_driver()

[Aleksandr Nogikh]

On Fri, Aug 14, 2026 at 11:42 AM 'syzbot' via
syzkaller-upstream-moderation
<syzkaller-upstream-moderation@googlegroups.com> wrote:
>
> A general protection fault can occur in __device_attach() due to a race
> condition between serio_add_port() and serio_interrupt() when device_add()
> fails.
>
> If device_add() fails (e.g., due to a memory allocation failure), it cleans
> up and sets dev->p = NULL. However, there is a brief window during
> device_add() where kobject_add() sets state_in_sysfs = 1, causing
> device_is_registered() to return true. If an interrupt occurs during this
> window, serio_interrupt() might queue a SERIO_RESCAN_PORT event.
>
> When the workqueue processes this stale event, it eventually calls
> serio_find_driver(), which directly invokes device_attach() without
> verifying if the device was successfully registered. This leads to a NULL
> pointer dereference when __device_attach() attempts to lock the device
> using the freed dev->p.
>
> Oops: general protection fault, probably for non-canonical address
> 0xdffffc0000000021: 0000 [#1] SMP KASAN NOPTI
> KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
> CPU: 1 UID: 0 PID: 5689 Comm: kworker/1:4 Not tainted
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
> 1.16.3-debian-1.16.3-2 04/01/2014
> Workqueue: events_long serio_handle_event
> RIP: 0010:__device_attach+0xb3/0x450 drivers/base/dd.c:1074
> Call Trace:
>  <TASK>
>  serio_find_driver drivers/input/serio/serio.c:112 [inline]
>  serio_handle_event+0x581/0x860 drivers/input/serio/serio.c:206
>  process_one_work kernel/workqueue.c:3322 [inline]
>  process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
>  worker_thread+0x92d/0xe10 kernel/workqueue.c:3486
>  kthread+0x388/0x470 kernel/kthread.c:436
>  ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
>  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>  </TASK>
>
> Fix this by checking if the device is registered in serio_find_driver()
> before attempting to attach a driver, safely ignoring any stale events for
> devices that failed registration.
>
> Fixes: ddf1ffbd40c9 ("Input: serio - let device core tell us if device was registered")
> Assisted-by: Gemini:gemini-3.6-flash Gemini:gemini-3.1-pro-preview syzbot
> Reported-by: syzbot+de42beb9ccc760a210ab@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=de42beb9ccc760a210ab
> Link: https://syzkaller.appspot.com/ai_job?id=4397f1ef-be0d-4e1b-897a-fcd37e50cc6b
> To: "Dmitry Torokhov" <dmitry.torokhov@gmail.com>
> To: <linux-input@vger.kernel.org>
> Cc: "Kees Cook" <kees@kernel.org>
> Cc: <linux-kernel@vger.kernel.org>
>
> ---
> diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
> index 54dd26249..c24e431af 100644
> --- a/drivers/input/serio/serio.c
> +++ b/drivers/input/serio/serio.c
> @@ -109,6 +109,9 @@ static void serio_find_driver(struct serio *serio)
>  {
>         int error;
>
> +       if (!device_is_registered(&serio->dev))
> +               return;
> +
>         error = device_attach(&serio->dev);
>         if (error < 0 && error != -EPROBE_DEFER)
>                 dev_warn(&serio->dev,
>
>


This papers over the real bug: serio_add_port() does not roll back
registration when device_add() fails.

Instead of defensive checks in serio_find_driver(), serio_add_port()
(and gameport_add_port()) must unwind on device_add() failure: stop
the port, unlink from lists, flush pending events with
serio_remove_pending_events(), and call put_device().

> base-commit: db2ddb87143519e20a95aa36c60b36107b736a58
> --
> This is an AI-generated patch subject to moderation.
> Reply with '#syz upstream' to Sign-off the patch as a human author
> and send it to the upstream kernel mailing lists.
> Reply with '#syz reject' to reject it ('#syz unreject' to undo).
>
> See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
> You can comment on the patch as usual, syzbot will try to address
> the comments and send a new version of the patch if necessary.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-upstream-moderation+unsubscribe@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/syzkaller-upstream-moderation/94a2df4a-c0d2-4a29-a692-e7250a623057%40mail.kernel.org.