linux-kernel - Re: [PATCH v2] HID: appletb-kbd: fix slab use-after-free bug in appletb_kbd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <no8r8855-p577-q694-srr5-31n49n2o9qr5@xreary.bet>
Date: Thu, 3 Jul 2025 11:35:32 +0200 (CEST)
From: Jiri Kosina <jikos@...nel.org>
To: Qasim Ijaz <qasdev00@...il.com>
cc: bentiss@...nel.org, gargaditya08@...e.com, linux-input@...r.kernel.org, 
    linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH v2] HID: appletb-kbd: fix slab use-after-free bug in
 appletb_kbd_probe

On Tue, 24 Jun 2025, Qasim Ijaz wrote:

> In probe appletb_kbd_probe() a "struct appletb_kbd *kbd" is allocated
> via devm_kzalloc() to store touch bar keyboard related data.
> Later on if backlight_device_get_by_name() finds a backlight device
> with name "appletb_backlight" a timer (kbd->inactivity_timer) is setup
> with appletb_inactivity_timer() and the timer is armed to run after
> appletb_tb_dim_timeout (60) seconds.
> 
> A use-after-free is triggered when failure occurs after the timer is
> armed. This ultimately means probe failure occurs and as a result the
> "struct appletb_kbd *kbd" which is device managed memory is freed.
> After 60 seconds the timer will have expired and __run_timers will
> attempt to access the timer (kbd->inactivity_timer) however the kdb
> structure has been freed causing a use-after free.

Thanks for reminding me of this one in the other thread. Now applied to 
hid.git#for-6.16/upstream-fixes.

-- 
Jiri Kosina
SUSE Labs