lkml.org 
[lkml]   [2019]   [May]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 23/99] HID: debug: fix race condition with between rdesc_show() and device removal
    Date
    [ Upstream commit cef0d4948cb0a02db37ebfdc320e127c77ab1637 ]

    There is a race condition that could happen if hid_debug_rdesc_show()
    is running while hdev is in the process of going away (device removal,
    system suspend, etc) which could result in NULL pointer dereference:

    BUG: unable to handle kernel paging request at 0000000783316040
    CPU: 1 PID: 1512 Comm: getevent Tainted: G U O 4.19.20-quilt-2e5dc0ac-00029-gc455a447dd55 #1
    RIP: 0010:hid_dump_device+0x9b/0x160
    Call Trace:
    hid_debug_rdesc_show+0x72/0x1d0
    seq_read+0xe0/0x410
    full_proxy_read+0x5f/0x90
    __vfs_read+0x3a/0x170
    vfs_read+0xa0/0x150
    ksys_read+0x58/0xc0
    __x64_sys_read+0x1a/0x20
    do_syscall_64+0x55/0x110
    entry_SYSCALL_64_after_hwframe+0x49/0xbe

    Grab driver_input_lock to make sure the input device exists throughout the
    whole process of dumping the rdesc.

    [jkosina@suse.cz: update changelog a bit]
    Signed-off-by: he, bo <bo.he@intel.com>
    Signed-off-by: "Zhang, Jun" <jun.zhang@intel.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/hid/hid-debug.c | 5 +++++
    1 file changed, 5 insertions(+)

    diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
    index ebc9ffde41e9..a353a011fbdf 100644
    --- a/drivers/hid/hid-debug.c
    +++ b/drivers/hid/hid-debug.c
    @@ -1060,10 +1060,15 @@ static int hid_debug_rdesc_show(struct seq_file *f, void *p)
    seq_printf(f, "\n\n");

    /* dump parsed data and input mappings */
    + if (down_interruptible(&hdev->driver_input_lock))
    + return 0;
    +
    hid_dump_device(hdev, f);
    seq_printf(f, "\n");
    hid_dump_input_mapping(hdev, f);

    + up(&hdev->driver_input_lock);
    +
    return 0;
    }

    --
    2.20.1


    \
     
     \ /
      Last update: 2019-05-06 17:08    [W:4.698 / U:1.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site