Messages in this thread Patch in this message | ![/](/images/icornerl.gif) | | Date | Thu, 30 Dec 2021 16:12:58 +0300 | Subject | Re: [syzbot] WARNING in atp_close (3) | From | Pavel Skripkin <> |
| |
On 10/3/21 03:00, syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: bf5b1e621a51 Add linux-next specific files for 20210927 > git tree: linux-next > console output: https://syzkaller.appspot.com/x/log.txt?x=11cc5bd3300000 > kernel config: https://syzkaller.appspot.com/x/.config?x=4b58fe22c337ee4a > dashboard link: https://syzkaller.appspot.com/bug?extid=b88c5eae27386b252bbd > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 > > Unfortunately, I don't have any reproducer for this issue yet. > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+b88c5eae27386b252bbd@syzkaller.appspotmail.com >
dev->work should be initialized before input_register_device(), since input_dev->close() calls cancel_work_sync()
#syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
With regards, Pavel Skripkindiff --git a/drivers/input/mouse/appletouch.c b/drivers/input/mouse/appletouch.c index bfa26651c0be..627048bc6a12 100644 --- a/drivers/input/mouse/appletouch.c +++ b/drivers/input/mouse/appletouch.c @@ -916,6 +916,8 @@ static int atp_probe(struct usb_interface *iface, set_bit(BTN_TOOL_TRIPLETAP, input_dev->keybit); set_bit(BTN_LEFT, input_dev->keybit); + INIT_WORK(&dev->work, atp_reinit); + error = input_register_device(dev->input); if (error) goto err_free_buffer; @@ -923,8 +925,6 @@ static int atp_probe(struct usb_interface *iface, /* save our data pointer in this interface device */ usb_set_intfdata(iface, dev); - INIT_WORK(&dev->work, atp_reinit); - return 0; err_free_buffer: | ![\](/images/icornerr.gif) |