hid_process_event() calls the driver's ->event() for every usage of a report, including fields that hidinput did not map to any input device, e.g. a constant input item. For those fields field->hidinput is NULL, and saitek_event() loads field->hidinput->input unconditionally: KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] RIP: 0010:saitek_event+0x51/0x2b0 drivers/hid/hid-saitek.c:154 hid_process_event drivers/hid/hid-core.c:1572 hid_report_raw_event drivers/hid/hid-core.c:2109 hid_input_report drivers/hid/hid-core.c:2180 hid_irq_in drivers/hid/usbhid/hid-core.c A device that claims to be a Saitek MMO7 and uses such a descriptor triggers it with a single input report. Bail out early when the input side is not claimed or the field has no input device, as the other HID drivers implementing ->event() do. The claimed check also covers a failed hidinput_connect(), which frees the hid_input structures without clearing field->hidinput. Fixes: 37c492c8f6a9 ("HID: quirk for Saitek RAT7 and MMO7 mices' mode button") Reported-by: syzbot+eba2b3201bd25a97cddf@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=eba2b3201bd25a97cddf Cc: stable@vger.kernel.org Signed-off-by: Nguyen Ngoc Thang --- v2: also check HID_CLAIMED_INPUT. hidinput_disconnect() frees the hid_input structures without clearing field->hidinput, so after a failed hidinput_connect() the pointer dangles while the probe still succeeds (->raw_event is set). Reported by Sashiko. drivers/hid/hid-saitek.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/hid/hid-saitek.c b/drivers/hid/hid-saitek.c index 6fe7c087c594..7e1160a24230 100644 --- a/drivers/hid/hid-saitek.c +++ b/drivers/hid/hid-saitek.c @@ -151,7 +151,12 @@ static int saitek_event(struct hid_device *hdev, struct hid_field *field, struct hid_usage *usage, __s32 value) { struct saitek_sc *ssc = hid_get_drvdata(hdev); - struct input_dev *input = field->hidinput->input; + struct input_dev *input; + + if (!(hdev->claimed & HID_CLAIMED_INPUT) || !field->hidinput) + return 0; + + input = field->hidinput->input; if (usage->type == EV_KEY && value && (((ssc->quirks & SAITEK_RELEASE_MODE_RAT7) && -- 2.43.0