github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 09:36:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

HID: hidpp: fix potential UAF in hidpp_connect_event()

Browse Source 
If input_register_device() fails, we call input_free_device(), but keep
stale pointer to the old device in hidpp->input, which could potentially
lead to UAF. Fix that by resetting it to NULL before returning from
hidpp_connect_event().

Reported-by: zdi-disclosures@trendmicro.com
Signed-off-by: Jiri Kosina <jkosina@suse.com>
This commit is contained in:
Jiri Kosina 2026-06-12 17:48:22 +02:00
parent b7799c3b6a
commit 6df6b1f2c4
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
drivers/hid/hid-logitech-hidpp.c
View File

@ -4295,6 +4295,7 @@ static void hidpp_connect_event(struct work_struct *work)
ret = input_register_device(input);
if (ret) {
hidpp->input = NULL;
input_free_device(input);
return;
}