Linux kernel source tree
Go to file
Jann Horn c2e39d5df0 HID: uhid: Fix worker destroying device without any protection
commit 4ea5763fb7 upstream.

uhid has to run hid_add_device() from workqueue context while allowing
parallel use of the userspace API (which is protected with ->devlock).
But hid_add_device() can fail. Currently, that is handled by immediately
destroying the associated HID device, without using ->devlock - but if
there are concurrent requests from userspace, that's wrong and leads to
NULL dereferences and/or memory corruption (via use-after-free).

Fix it by leaving the HID device as-is in the worker. We can clean it up
later, either in the UHID_DESTROY command handler or in the ->release()
handler.

Cc: stable@vger.kernel.org
Fixes: 67f8ecc550 ("HID: uhid: fix timeout when probe races with IO")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-01-27 10:53:40 +01:00
arch KVM: VMX: switch blocked_vcpu_on_cpu_lock to raw spinlock 2022-01-27 10:53:40 +01:00
block iocost: Fix divide-by-zero on donation from low hweight cgroup 2021-12-22 09:30:57 +01:00
certs certs: Trigger creation of RSA module signing key if it's not an RSA key 2021-09-15 09:50:29 +02:00
crypto crypto: pcrypt - Delay write to padata->info 2021-11-18 14:04:12 +01:00
Documentation bpf: Add kconfig knob for disabling unpriv bpf by default 2022-01-05 12:40:34 +01:00
drivers HID: uhid: Fix worker destroying device without any protection 2022-01-27 10:53:40 +01:00
fs 9p: only copy valid iattrs in 9P2000.L setattr implementation 2022-01-20 09:17:50 +01:00
include perf: Protect perf_guest_cbs with RCU 2022-01-20 09:17:50 +01:00
init bpf: Add kconfig knob for disabling unpriv bpf by default 2022-01-05 12:40:34 +01:00
ipc shm: extend forced shm destroy to support objects from several IPC nses 2021-12-01 09:19:10 +01:00
kernel perf: Protect perf_guest_cbs with RCU 2022-01-20 09:17:50 +01:00
lib siphash: use _unaligned version by default 2021-12-08 09:03:23 +01:00
LICENSES
mm mm: mempolicy: fix THP allocations escaping mempolicy restrictions 2021-12-29 12:26:06 +01:00
net can: isotp: convert struct tpcon::{idx,len} to unsigned int 2022-01-16 09:14:23 +01:00
samples ftrace/samples: Add missing prototypes direct functions 2022-01-11 15:25:00 +01:00
scripts recordmcount.pl: fix typo in s390 mcount regex 2022-01-05 12:40:29 +01:00
security selinux: initialize proto variable in selinux_ip_postroute_compat() 2022-01-05 12:40:30 +01:00
sound ALSA: hda/realtek: Re-order quirk entries for Lenovo 2022-01-20 09:17:51 +01:00
tools selftests: x86: fix [-Wstringop-overread] warn in test_process_vm_readv() 2022-01-11 15:24:58 +01:00
usr
virt KVM: downgrade two BUG_ONs to WARN_ON_ONCE 2021-12-22 09:30:50 +01:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore kbuild: generate Module.symvers only when vmlinux exists 2021-05-19 10:12:59 +02:00
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS MAINTAINERS: adjust GCC PLUGINS after gcc-plugin.sh removal 2021-12-14 11:32:46 +01:00
Makefile Linux 5.10.93 2022-01-20 09:17:52 +01:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.