linux-kernel - Re: [PATCH v2 RESEND 1/2] Input: alps - fix use-after-free bugs caused by dev3_register

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <mu6hzf73k5updemoun7fdcgq4y6rvic3mghwpxpljm3j7ngkih@j5plzc3pjeie>
Date: Wed, 17 Dec 2025 10:08:52 -0800
From: Dmitry Torokhov <dmitry.torokhov@...il.com>
To: Duoming Zhou <duoming@....edu.cn>
Cc: linux-input@...r.kernel.org, linux-kernel@...r.kernel.org, 
	pali@...nel.org, kuba@...nel.org, alexander.deucher@....com, 
	akpm@...ux-foundation.org, johannes.berg@...el.com, pkshih@...ltek.com, 
	hverkuil+cisco@...nel.org, andriy.shevchenko@...ux.intel.com, tglx@...utronix.de, 
	mingo@...nel.org, stable@...nel.org
Subject: Re: [PATCH v2 RESEND 1/2] Input: alps - fix use-after-free bugs
 caused by dev3_register_work

On Wed, Dec 17, 2025 at 11:00:17AM +0800, Duoming Zhou wrote:
> The dev3_register_work delayed work item is initialized within
> alps_reconnect() and scheduled upon receipt of the first bare
> PS/2 packet from an external PS/2 device connected to the ALPS
> touchpad. During device detachment, the original implementation
> calls flush_workqueue() in psmouse_disconnect() to ensure
> completion of dev3_register_work. However, the flush_workqueue()
> in psmouse_disconnect() only blocks and waits for work items that
> were already queued to the workqueue prior to its invocation. Any
> work items submitted after flush_workqueue() is called are not
> included in the set of tasks that the flush operation awaits.
> This means that after flush_workqueue() has finished executing,
> the dev3_register_work could still be scheduled. Although the
> psmouse state is set to PSMOUSE_CMD_MODE in psmouse_disconnect(),
> the scheduling of dev3_register_work remains unaffected.
> 
> The race condition can occur as follows:
> 
> CPU 0 (cleanup path)     | CPU 1 (delayed work)
> psmouse_disconnect()     |
>   psmouse_set_state()    |
>   flush_workqueue()      | alps_report_bare_ps2_packet()
>   alps_disconnect()      |   psmouse_queue_work()
>     kfree(priv); // FREE | alps_register_bare_ps2_mouse()
>                          |   priv = container_of(work...); // USE
>                          |   priv->dev3 // USE
> 
> Add disable_delayed_work_sync() in alps_disconnect() to ensure
> that dev3_register_work is properly canceled and prevented from
> executing after the alps_data structure has been deallocated.
> 
> This bug is identified by static analysis.
> 
> Fixes: 04aae283ba6a ("Input: ALPS - do not mix trackstick and external PS/2 mouse data")
> Cc: stable@...nel.org
> Signed-off-by: Duoming Zhou <duoming@....edu.cn>

Applied, thank you.

-- 
Dmitry