* Re: [PATCH] input: lkkbd: cancel pending work before freeing device
2025-12-11 3:11 [PATCH] input: lkkbd: cancel pending work before freeing device Minseong Kim
@ 2025-12-12 4:36 ` Dmitry Torokhov
2025-12-12 5:14 ` [PATCH] input: lkkbd: disable " Minseong Kim
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: Dmitry Torokhov @ 2025-12-12 4:36 UTC (permalink / raw)
To: Minseong Kim; +Cc: linux-input, linux-kernel, stable
Hi Minseong,
On Thu, Dec 11, 2025 at 12:11:31PM +0900, Minseong Kim wrote:
> lkkbd_interrupt() schedules lk->tq with schedule_work(), and the work
> handler lkkbd_reinit() dereferences the lkkbd structure and its
> serio/input_dev fields.
>
> lkkbd_disconnect() frees the lkkbd structure without cancelling this
> work, so the work can run after the structure has been freed, leading
> to a potential use-after-free.
>
> Cancel the pending work in lkkbd_disconnect() before unregistering and
> freeing the device, following the same pattern as sunkbd.
Thank you for spotting this.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: Minseong Kim <ii4gsp@gmail.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: Minseong Kim <ii4gsp@gmail.com>
> ---
> drivers/input/keyboard/lkkbd.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/input/keyboard/lkkbd.c b/drivers/input/keyboard/lkkbd.c
> index c035216dd27c..72c477aab1fc 100644
> --- a/drivers/input/keyboard/lkkbd.c
> +++ b/drivers/input/keyboard/lkkbd.c
> @@ -684,6 +684,8 @@ static void lkkbd_disconnect(struct serio *serio)
> {
> struct lkkbd *lk = serio_get_drvdata(serio);
>
> + cancel_work_sync(&lk->tq);
We should use disable_work_sync() here because even if we cancel the
work there is a chance it will be queued again (up until the moment
serio_close() returns).
We also need to call disable_work_sync() in lkkbd_connect() in error
paths once serio_open() has been called.
Thanks.
--
Dmitry
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH] input: lkkbd: disable pending work before freeing device
2025-12-11 3:11 [PATCH] input: lkkbd: cancel pending work before freeing device Minseong Kim
2025-12-12 4:36 ` Dmitry Torokhov
@ 2025-12-12 5:14 ` Minseong Kim
2025-12-12 5:16 ` Minseong Kim
2025-12-12 5:23 ` [PATCH v2] " Minseong Kim
3 siblings, 0 replies; 6+ messages in thread
From: Minseong Kim @ 2025-12-12 5:14 UTC (permalink / raw)
To: dmitry.torokhov; +Cc: linux-input, linux-kernel, stable
lkkbd_interrupt() schedules lk->tq via schedule_work(), and the work
handler lkkbd_reinit() dereferences the lkkbd structure and its
serio/input_dev fields.
lkkbd_disconnect() and error paths in lkkbd_connect() free the lkkbd
structure without preventing the reinit work from being queued again
until serio_close() returns. This can allow the work handler to run
after the structure has been freed, leading to a potential use-after-free.
Use disable_work_sync() instead of cancel_work_sync() to ensure the
reinit work cannot be re-queued, and call it both in lkkbd_disconnect()
and in lkkbd_connect() error paths after serio_open().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Minseong Kim <ii4gsp@gmail.com>
---
drivers/input/keyboard/lkkbd.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/input/keyboard/lkkbd.c b/drivers/input/keyboard/lkkbd.c
index c035216dd27c..12a467ce00b5 100644
--- a/drivers/input/keyboard/lkkbd.c
+++ b/drivers/input/keyboard/lkkbd.c
@@ -670,7 +670,8 @@ static int lkkbd_connect(struct serio *serio, struct serio_driver *drv)
return 0;
- fail3: serio_close(serio);
+ fail3: disable_work_sync(&lk->tq);
+ serio_close(serio);
fail2: serio_set_drvdata(serio, NULL);
fail1: input_free_device(input_dev);
kfree(lk);
@@ -684,6 +685,8 @@ static void lkkbd_disconnect(struct serio *serio)
{
struct lkkbd *lk = serio_get_drvdata(serio);
+ disable_work_sync(&lk->tq);
+
input_get_device(lk->dev);
input_unregister_device(lk->dev);
serio_close(serio);
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH] input: lkkbd: disable pending work before freeing device
2025-12-11 3:11 [PATCH] input: lkkbd: cancel pending work before freeing device Minseong Kim
2025-12-12 4:36 ` Dmitry Torokhov
2025-12-12 5:14 ` [PATCH] input: lkkbd: disable " Minseong Kim
@ 2025-12-12 5:16 ` Minseong Kim
2025-12-12 5:23 ` [PATCH v2] " Minseong Kim
3 siblings, 0 replies; 6+ messages in thread
From: Minseong Kim @ 2025-12-12 5:16 UTC (permalink / raw)
To: linux-input; +Cc: dmitry.torokhov, linux-kernel, stable
lkkbd_interrupt() schedules lk->tq via schedule_work(), and the work
handler lkkbd_reinit() dereferences the lkkbd structure and its
serio/input_dev fields.
lkkbd_disconnect() and error paths in lkkbd_connect() free the lkkbd
structure without preventing the reinit work from being queued again
until serio_close() returns. This can allow the work handler to run
after the structure has been freed, leading to a potential use-after-free.
Use disable_work_sync() instead of cancel_work_sync() to ensure the
reinit work cannot be re-queued, and call it both in lkkbd_disconnect()
and in lkkbd_connect() error paths after serio_open().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Minseong Kim <ii4gsp@gmail.com>
---
drivers/input/keyboard/lkkbd.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/input/keyboard/lkkbd.c b/drivers/input/keyboard/lkkbd.c
index c035216dd27c..12a467ce00b5 100644
--- a/drivers/input/keyboard/lkkbd.c
+++ b/drivers/input/keyboard/lkkbd.c
@@ -670,7 +670,8 @@ static int lkkbd_connect(struct serio *serio, struct serio_driver *drv)
return 0;
- fail3: serio_close(serio);
+ fail3: disable_work_sync(&lk->tq);
+ serio_close(serio);
fail2: serio_set_drvdata(serio, NULL);
fail1: input_free_device(input_dev);
kfree(lk);
@@ -684,6 +685,8 @@ static void lkkbd_disconnect(struct serio *serio)
{
struct lkkbd *lk = serio_get_drvdata(serio);
+ disable_work_sync(&lk->tq);
+
input_get_device(lk->dev);
input_unregister_device(lk->dev);
serio_close(serio);
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH v2] input: lkkbd: disable pending work before freeing device
2025-12-11 3:11 [PATCH] input: lkkbd: cancel pending work before freeing device Minseong Kim
` (2 preceding siblings ...)
2025-12-12 5:16 ` Minseong Kim
@ 2025-12-12 5:23 ` Minseong Kim
2025-12-12 8:46 ` Dmitry Torokhov
3 siblings, 1 reply; 6+ messages in thread
From: Minseong Kim @ 2025-12-12 5:23 UTC (permalink / raw)
To: dmitry.torokhov; +Cc: linux-input, linux-kernel, stable
lkkbd_interrupt() schedules lk->tq via schedule_work(), and the work
handler lkkbd_reinit() dereferences the lkkbd structure and its
serio/input_dev fields.
lkkbd_disconnect() and error paths in lkkbd_connect() free the lkkbd
structure without preventing the reinit work from being queued again
until serio_close() returns. This can allow the work handler to run
after the structure has been freed, leading to a potential use-after-free.
Use disable_work_sync() instead of cancel_work_sync() to ensure the
reinit work cannot be re-queued, and call it both in lkkbd_disconnect()
and in lkkbd_connect() error paths after serio_open().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Minseong Kim <ii4gsp@gmail.com>
---
drivers/input/keyboard/lkkbd.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/input/keyboard/lkkbd.c b/drivers/input/keyboard/lkkbd.c
index c035216dd27c..12a467ce00b5 100644
--- a/drivers/input/keyboard/lkkbd.c
+++ b/drivers/input/keyboard/lkkbd.c
@@ -670,7 +670,8 @@ static int lkkbd_connect(struct serio *serio, struct serio_driver *drv)
return 0;
- fail3: serio_close(serio);
+ fail3: disable_work_sync(&lk->tq);
+ serio_close(serio);
fail2: serio_set_drvdata(serio, NULL);
fail1: input_free_device(input_dev);
kfree(lk);
@@ -684,6 +685,8 @@ static void lkkbd_disconnect(struct serio *serio)
{
struct lkkbd *lk = serio_get_drvdata(serio);
+ disable_work_sync(&lk->tq);
+
input_get_device(lk->dev);
input_unregister_device(lk->dev);
serio_close(serio);
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH v2] input: lkkbd: disable pending work before freeing device
2025-12-12 5:23 ` [PATCH v2] " Minseong Kim
@ 2025-12-12 8:46 ` Dmitry Torokhov
0 siblings, 0 replies; 6+ messages in thread
From: Dmitry Torokhov @ 2025-12-12 8:46 UTC (permalink / raw)
To: Minseong Kim; +Cc: linux-input, linux-kernel, stable
On Fri, Dec 12, 2025 at 02:23:14PM +0900, Minseong Kim wrote:
> lkkbd_interrupt() schedules lk->tq via schedule_work(), and the work
> handler lkkbd_reinit() dereferences the lkkbd structure and its
> serio/input_dev fields.
>
> lkkbd_disconnect() and error paths in lkkbd_connect() free the lkkbd
> structure without preventing the reinit work from being queued again
> until serio_close() returns. This can allow the work handler to run
> after the structure has been freed, leading to a potential use-after-free.
>
> Use disable_work_sync() instead of cancel_work_sync() to ensure the
> reinit work cannot be re-queued, and call it both in lkkbd_disconnect()
> and in lkkbd_connect() error paths after serio_open().
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Minseong Kim <ii4gsp@gmail.com>
Applied, thank you.
--
Dmitry
^ permalink raw reply [flat|nested] 6+ messages in thread