From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: "dan.carpenter@oracle.com" <dan.carpenter@oracle.com>,
syzbot+784ccb935f9900cc7c9e@syzkaller.appspotmail.com,
Alan Stern <stern@rowland.harvard.edu>,
Jiri Kosina <jkosina@suse.cz>, Sasha Levin <sashal@kernel.org>,
linux-usb@vger.kernel.org, linux-input@vger.kernel.org
Subject: [PATCH AUTOSEL 5.4 05/58] HID: hiddev: Fix race in in hiddev_disconnect()
Date: Thu, 5 Mar 2020 12:13:26 -0500 [thread overview]
Message-ID: <20200305171420.29595-5-sashal@kernel.org> (raw)
In-Reply-To: <20200305171420.29595-1-sashal@kernel.org>
From: "dan.carpenter@oracle.com" <dan.carpenter@oracle.com>
[ Upstream commit 5c02c447eaeda29d3da121a2e17b97ccaf579b51 ]
Syzbot reports that "hiddev" is used after it's free in hiddev_disconnect().
The hiddev_disconnect() function sets "hiddev->exist = 0;" so
hiddev_release() can free it as soon as we drop the "existancelock"
lock. This patch moves the mutex_unlock(&hiddev->existancelock) until
after we have finished using it.
Reported-by: syzbot+784ccb935f9900cc7c9e@syzkaller.appspotmail.com
Fixes: 7f77897ef2b6 ("HID: hiddev: fix potential use-after-free")
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/usbhid/hiddev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index c879b214a4797..35b1fa6d962ec 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -941,9 +941,9 @@ void hiddev_disconnect(struct hid_device *hid)
hiddev->exist = 0;
if (hiddev->open) {
- mutex_unlock(&hiddev->existancelock);
hid_hw_close(hiddev->hid);
wake_up_interruptible(&hiddev->wait);
+ mutex_unlock(&hiddev->existancelock);
} else {
mutex_unlock(&hiddev->existancelock);
kfree(hiddev);
--
2.20.1
next prev parent reply other threads:[~2020-03-05 17:14 UTC|newest]
Thread overview: 51+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-05 17:13 [PATCH AUTOSEL 5.4 01/58] ACPI: watchdog: Allow disabling WDAT at boot Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 02/58] HID: apple: Add support for recent firmware on Magic Keyboards Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 03/58] HID: core: fix off-by-one memset in hid_report_raw_event() Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 04/58] HID: core: increase HID report buffer size to 8KiB Sasha Levin
2020-03-05 17:13 ` Sasha Levin [this message]
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 06/58] HID: alps: Fix an error handling path in 'alps_input_configured()' Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 07/58] i2c: altera: Fix potential integer overflow Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 08/58] ACPI: watchdog: Set default timeout in probe Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 09/58] HID: i2c-hid: add Trekstor Surfbook E11B to descriptor override Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 10/58] mips: vdso: fix 'jalr t9' crash in vdso code Sasha Levin
2020-08-29 13:08 ` Hauke Mehrtens
2020-08-29 13:56 ` Sasha Levin
2020-08-29 14:37 ` Hauke Mehrtens
2020-08-30 2:23 ` Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 11/58] MIPS: Disable VDSO time functionality on microMIPS Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 12/58] mips: vdso: add build time check that no 'jalr t9' calls left Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 13/58] MIPS: VPE: Fix a double free and a memory leak in 'release_vpe()' Sasha Levin
2020-03-05 17:13 ` Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 14/58] HID: hid-bigbenff: fix general protection fault caused by double kfree Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 15/58] HID: hid-bigbenff: call hid_hw_stop() in case of error Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 16/58] HID: hid-bigbenff: fix race condition for scheduled work during removal Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 17/58] MIPS: vdso: Wrap -mexplicit-relocs in cc-option Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 18/58] selftests/rseq: Fix out-of-tree compilation Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 19/58] tracing: Fix number printing bug in print_synth_event() Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 20/58] nl80211: fix potential leak in AP start Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 21/58] cfg80211: check reg_rule for NULL in handle_channel_custom() Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 22/58] mac80211: Remove a redundant mutex unlock Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 23/58] scsi: libfc: free response frame from GPN_ID Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 24/58] netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 25/58] netfilter: ipset: Fix forceadd evaluation path Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 26/58] vhost: Check docket sk_family instead of call getname Sasha Levin
2020-03-05 17:13 ` Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 27/58] net: usb: qmi_wwan: restore mtu min/max values after raw_ip switch Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 28/58] hv_netvsc: Fix unwanted wakeup in netvsc_attach() Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 29/58] net: ks8851-ml: Fix IRQ handling and locking Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 30/58] mac80211: rx: avoid RCU list traversal under mutex Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 31/58] net: ll_temac: Fix race condition causing TX hang Sasha Levin
2020-03-05 17:13 ` Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 32/58] net: ll_temac: Add more error handling of dma_map_single() calls Sasha Levin
2020-03-05 17:13 ` Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 33/58] net: ll_temac: Fix RX buffer descriptor handling on GFP_ATOMIC pressure Sasha Levin
2020-03-05 17:13 ` Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 34/58] net: ll_temac: Handle DMA halt condition caused by buffer underrun Sasha Levin
2020-03-05 17:13 ` Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 35/58] blk-mq: insert passthrough request into hctx->dispatch directly Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 36/58] drm/amdgpu: fix memory leak during TDR test(v2) Sasha Levin
2020-03-05 17:13 ` Sasha Levin
2020-03-05 17:13 ` Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 37/58] kbuild: fix DT binding schema rule to detect command line changes Sasha Levin
2020-03-05 17:13 ` [PATCH AUTOSEL 5.4 38/58] kbuild: add dtbs_check to PHONY Sasha Levin
2020-03-05 17:14 ` [PATCH AUTOSEL 5.4 39/58] kbuild: add dt_binding_check to PHONY in a correct place Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200305171420.29595-5-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=dan.carpenter@oracle.com \
--cc=jkosina@suse.cz \
--cc=linux-input@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=stern@rowland.harvard.edu \
--cc=syzbot+784ccb935f9900cc7c9e@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.