Re: test HID UAF

[syzbot]

> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

This crash does not have a reproducer. I cannot test it.

> master
> From aef1e103488c6a668bea9ba9e74e27a75c0be4b3 Mon Sep 17 00:00:00 2001
> From: Hyeonsu Choi <chlgus...@gmail.com>
> Date: Tue, 14 Jul 2026 18:50:00 +0900
> Subject: [PATCH] HID: input: allocate input_dev name/phys/uniq using
> hid device devres
>
> input_dev->name, phys, and uniq are directly assigned from hid_device.
> It causes a slab-use-after-free bug if the input device outlives the
> parent HID device during teardown.
> Fix this by using devm_kstrdup() tied to &hid->dev for name, phys, and
> uniq strings.
> The string lifetime is tied to the parent HID device, preventing a
> potential slab-use-after-free bug.
> Also add OOM error handling for these allocations.
>
> Reported-by: syzbot+aec196...@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=aec1962419768c5caf88
> Signed-off-by: Hyeonsu Choi <chlgus...@gmail.com>
> ---
> drivers/hid/hid-input.c | 19 ++++++++++++++++---
> 1 file changed, 16 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
> index 3487600cadb4..da6b338f18ba 100644
> --- a/drivers/hid/hid-input.c
> +++ b/drivers/hid/hid-input.c
> @@ -2125,10 +2125,21 @@ static struct hid_input
> *hidinput_allocate(struct hid_device *hid,
> input_dev->close = hidinput_close;
> input_dev->setkeycode = hidinput_setkeycode;
> input_dev->getkeycode = hidinput_getkeycode;
> +
> + const char *name = hidinput->name ? hidinput->name : hid->name;
> +
> + input_dev->name = devm_kstrdup(&hid->dev, name, GFP_KERNEL);
> + if (!input_dev->name)
> + goto fail;
> +
> + input_dev->phys = devm_kstrdup(&hid->dev, hid->phys, GFP_KERNEL);
> + if (!input_dev->phys)
> + goto fail;
> +
> + input_dev->uniq = devm_kstrdup(&hid->dev, hid->uniq, GFP_KERNEL);
> + if (!input_dev->uniq)
> + goto fail;
>
> - input_dev->name = hidinput->name ? hidinput->name : hid->name;
> - input_dev->phys = hid->phys;
> - input_dev->uniq = hid->uniq;
> input_dev->id.bustype = hid->bus;
> input_dev->id.vendor = hid->vendor;
> input_dev->id.product = hid->product;
> @@ -2144,6 +2155,8 @@ static struct hid_input
> *hidinput_allocate(struct hid_device *hid,
> return hidinput;
>
> fail:
> + if (hidinput)
> + kfree(hidinput->name);
> kfree(hidinput);
> input_free_device(input_dev);
> hid_err(hid, "Out of memory during hid input probe\n");
> --
> 2.53.0