github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

HID: hiddev: keep state alive through disconnect unlock

Browse Source 
mutex_unlock() clears the mutex owner before taking its wait lock. A
thread spinning in the final hiddev file release can acquire
existancelock after hiddev_disconnect() clears the owner, then free
hiddev before the disconnecting thread reaches the mutex wait lock. This
causes a use-after-free in the mutex slow unlock path.

Give the connection and each open file an explicit reference. Drop each
reference only after its existancelock critical section has completed,
so neither unlock path can free the mutex while the other is still using
it.

Fixes: 079034073f ("HID: hiddev cleanup -- handle all error conditions properly")
Reported-by: syzbot+563191a4939ddbfe73d4@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=563191a4939ddbfe73d4
Cc: stable@vger.kernel.org
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Link: https://syzkaller.appspot.com/bug?extid=563191a4939ddbfe73d4
Signed-off-by: Jiri Kosina <jkosina@suse.com>
This commit is contained in:
Yousef Alhouseen 2026-06-29 17:29:47 +02:00 committed by Jiri Kosina
parent 986c24e0fe
commit 03f449b5de
2 changed files with 21 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
drivers/hid/usbhid/hiddev.c
View File

@ -46,6 +46,12 @@ struct hiddev_list {
struct mutex thread_lock;
};
static void hiddev_put(struct hiddev *hiddev)
{
if (refcount_dec_and_test(&hiddev->refcount))
kfree(hiddev);
}
/*
* Find a report, given the report's type and ID. The ID can be specified
* indirectly by REPORT_ID_FIRST (which returns the first report of the given
@ -216,26 +222,21 @@ static int hiddev_fasync(int fd, struct file *file, int on)
static int hiddev_release(struct inode * inode, struct file * file)
{
struct hiddev_list *list = file->private_data;
struct hiddev *hiddev = list->hiddev;
unsigned long flags;
spin_lock_irqsave(&list->hiddev->list_lock, flags);
spin_lock_irqsave(&hiddev->list_lock, flags);
list_del(&list->node);
spin_unlock_irqrestore(&list->hiddev->list_lock, flags);
spin_unlock_irqrestore(&hiddev->list_lock, flags);
mutex_lock(&list->hiddev->existancelock);
if (!--list->hiddev->open) {
if (list->hiddev->exist) {
hid_hw_close(list->hiddev->hid);
hid_hw_power(list->hiddev->hid, PM_HINT_NORMAL);
} else {
mutex_unlock(&list->hiddev->existancelock);
kfree(list->hiddev);
vfree(list);
return 0;
}
mutex_lock(&hiddev->existancelock);
if (!--hiddev->open && hiddev->exist) {
hid_hw_close(hiddev->hid);
hid_hw_power(hiddev->hid, PM_HINT_NORMAL);
}
mutex_unlock(&list->hiddev->existancelock);
mutex_unlock(&hiddev->existancelock);
hiddev_put(hiddev);
vfree(list);
return 0;
@ -270,6 +271,7 @@ static int __hiddev_open(struct hiddev *hiddev, struct file *file)
spin_unlock_irq(&hiddev->list_lock);
file->private_data = list;
refcount_inc(&hiddev->refcount);
return 0;
@ -897,6 +899,7 @@ int hiddev_connect(struct hid_device *hid, unsigned int force)
INIT_LIST_HEAD(&hiddev->list);
spin_lock_init(&hiddev->list_lock);
mutex_init(&hiddev->existancelock);
refcount_set(&hiddev->refcount, 1);
hid->hiddev = hiddev;
hiddev->hid = hid;
hiddev->exist = 1;
@ -937,9 +940,7 @@ void hiddev_disconnect(struct hid_device *hid)
if (hiddev->open) {
hid_hw_close(hiddev->hid);
wake_up_interruptible(&hiddev->wait);
mutex_unlock(&hiddev->existancelock);
} else {
mutex_unlock(&hiddev->existancelock);
kfree(hiddev);
}
mutex_unlock(&hiddev->existancelock);
hiddev_put(hiddev);
}

2
include/linux/hiddev.h
View File

@ -13,6 +13,7 @@
#ifndef _HIDDEV_H
#define _HIDDEV_H
#include <linux/refcount.h>
#include <uapi/linux/hiddev.h>
@ -24,6 +25,7 @@ struct hiddev {
int minor;
int exist;
int open;
refcount_t refcount;
struct mutex existancelock;
wait_queue_head_t wait;
struct hid_device *hid;