A general protection fault can occur in __device_attach() due to a race
condition between serio_add_port() and serio_interrupt() when device_add()
fails.
If device_add() fails (e.g., due to a memory allocation failure), it cleans
up and sets dev->p = NULL. However, there is a brief window during
device_add() where kobject_add() sets state_in_sysfs = 1, causing
device_is_registered() to return true. If an interrupt occurs during this
window, serio_interrupt() might queue a SERIO_RESCAN_PORT event.
When the workqueue processes this stale event, it eventually calls
serio_find_driver(), which directly invokes device_attach() without
verifying if the device was successfully registered. This leads to a NULL
pointer dereference when __device_attach() attempts to lock the device
using the freed dev->p.
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000021: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
CPU: 1 UID: 0 PID: 5689 Comm: kworker/1:4 Not tainted
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events_long serio_handle_event
RIP: 0010:__device_attach+0xb3/0x450 drivers/base/dd.c:1074
Call Trace:
serio_find_driver drivers/input/serio/serio.c:112 [inline]
serio_handle_event+0x581/0x860 drivers/input/serio/serio.c:206
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
worker_thread+0x92d/0xe10 kernel/workqueue.c:3486
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Fix this by checking if the device is registered in serio_find_driver()
before attempting to attach a driver, safely ignoring any stale events for
devices that failed registration.
Fixes: ddf1ffbd40c9 ("Input: serio - let device core tell us if device was registered")
Assisted-by: Gemini:gemini-3.6-flash Gemini:gemini-3.1-pro-preview syzbot
Reported-by: syzbot+de42beb9ccc760a210ab@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=de42beb9ccc760a210ab
Link: https://syzkaller.appspot.com/ai_job?id=4397f1ef-be0d-4e1b-897a-fcd37e50cc6b
To: "Dmitry Torokhov"
To:
Cc: "Kees Cook"
Cc:
---
diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
index 54dd26249..c24e431af 100644
--- a/drivers/input/serio/serio.c
+++ b/drivers/input/serio/serio.c
@@ -109,6 +109,9 @@ static void serio_find_driver(struct serio *serio)
{
int error;
+ if (!device_is_registered(&serio->dev))
+ return;
+
error = device_attach(&serio->dev);
if (error < 0 && error != -EPROBE_DEFER)
dev_warn(&serio->dev,
base-commit: db2ddb87143519e20a95aa36c60b36107b736a58
--
This is an AI-generated patch subject to moderation.
Reply with '#syz upstream' to Sign-off the patch as a human author
and send it to the upstream kernel mailing lists.
Reply with '#syz reject' to reject it ('#syz unreject' to undo).
See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
You can comment on the patch as usual, syzbot will try to address
the comments and send a new version of the patch if necessary.
syzbot engineers can be reached at syzkaller@googlegroups.com.