linux-kernel - Re: [syzbot] [input?] [usb?] KASAN: slab-use-after-free Read in steam_input

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <tencent_B22DF56DC89700E9F2EF4ECDEC797E6F9C0A@qq.com>
Date: Mon, 24 Feb 2025 20:04:41 +0800
From: Edward Adam Davis <eadavis@...com>
To: syzbot+0154da2d403396b2bd59@...kaller.appspotmail.com
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [input?] [usb?] KASAN: slab-use-after-free Read in steam_input_open

#syz test

diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
index c9e65e9088b3..12ad00be57bc 100644
--- a/drivers/hid/hid-steam.c
+++ b/drivers/hid/hid-steam.c
@@ -1139,6 +1139,9 @@ static int steam_client_ll_open(struct hid_device *hdev)
 	struct steam_device *steam = hdev->driver_data;
 	unsigned long flags;
 
+	if (!steam->client_hdev)
+		return;
+
 	spin_lock_irqsave(&steam->lock, flags);
 	steam->client_opened++;
 	spin_unlock_irqrestore(&steam->lock, flags);
@@ -1153,11 +1156,12 @@ static void steam_client_ll_close(struct hid_device *hdev)
 	struct steam_device *steam = hdev->driver_data;
 
 	unsigned long flags;
-	bool connected;
+
+	if (!steam->client_hdev)
+		return;
 
 	spin_lock_irqsave(&steam->lock, flags);
 	steam->client_opened--;
-	connected = steam->connected && !steam->client_opened;
 	spin_unlock_irqrestore(&steam->lock, flags);
 
 	schedule_work(&steam->unregister_work);