Re: [syzbot] [input?] [usb?] KASAN: slab-use-after-free Read in hidraw_report_event

Edward Adam Davis
2026-04-27T05:07:06Z

#syz test

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 61afec5915ec..0b588e002834 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2353,14 +2353,16 @@ EXPORT_SYMBOL_GPL(hid_connect);

void hid_disconnect(struct hid_device *hdev)
{
+ unsigned claimed = hdev->claimed;
+ hdev->claimed = 0;
+
device_remove_file(&hdev->dev, &dev_attr_country);
- if (hdev->claimed & HID_CLAIMED_INPUT)
+ if (claimed & HID_CLAIMED_INPUT)
hidinput_disconnect(hdev);
- if (hdev->claimed & HID_CLAIMED_HIDDEV)
+ if (claimed & HID_CLAIMED_HIDDEV)
hdev->hiddev_disconnect(hdev);
- if (hdev->claimed & HID_CLAIMED_HIDRAW)
+ if (claimed & HID_CLAIMED_HIDRAW)
hidraw_disconnect(hdev);
- hdev->claimed = 0;

hid_bpf_disconnect_device(hdev);
}