Re: [syzbot] [input?] [usb?] KASAN: slab-use-after-free Read in hidraw_report_event

Edward Adam Davis
2026-04-27T09:18:33Z

#syz test

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 0b588e002834..8739f794d80a 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2144,12 +2144,18 @@ static int __hid_input_report(struct hid_device *hid, enum hid_report_type type,
}

if (hdrv && hdrv->raw_event && hid_match_report(hid, report)) {
+ printk("before psu raw event, hid: %p claimed: %u, size: %u, "
+ "data: %p, %s\n", hid, hid->claimed, size, data,
+ __func__);
ret = hdrv->raw_event(hid, report, data, size);
+ printk("after psu raw event, hid: %p claimed: %u, %s\n",
+ hid, hid->claimed, __func__);
if (ret < 0)
goto unlock;
}

ret = hid_report_raw_event(hid, type, data, size, interrupt);
+ printk("after report raw event, hid: %p, %s\n", hid, __func__);

unlock:
if (!lock_already_taken)
@@ -2818,8 +2824,11 @@ static int hid_device_probe(struct device *dev)
hdev->io_started = false;
clear_bit(ffs(HID_STAT_REPROBED), &hdev->status);

- if (!hdev->driver)
+ if (!hdev->driver) {
+ printk("before hid dev probe, hid: %p, %s\n", hdev, __func__);
ret = __hid_device_probe(hdev, hdrv);
+ printk("after hid dev probe, hid: %p, %s\n", hdev, __func__);
+ }

if (!hdev->io_started)
up(&hdev->driver_input_lock);