All of lore.kernel.org
 help / color / mirror / Atom feed
From: Pietro Borrello <borrello@diag.uniroma1.it>
To: Roderick Colenbrander <thunderbird2k@gmail.com>
Cc: Pietro Borrello <borrello@diag.uniroma1.it>,
	linux-leds@vger.kernel.org,
	Cristiano Giuffrida <c.giuffrida@vu.nl>,
	"Bos, H.J." <h.j.bos@vu.nl>, Jakob Koschel <jkl820.git@gmail.com>,
	linux-input@vger.kernel.org, linux-kernel@vger.kernel.org,
	Jiri Kosina <jkosina@suse.cz>,
	Roderick Colenbrander <roderick@gaikai.com>,
	Jiri Kosina <jikos@kernel.org>,
	Benjamin Tissoires <benjamin.tissoires@redhat.com>,
	Hanno Zulla <kontakt@hanno.de>, Pavel Machek <pavel@ucw.cz>,
	Lee Jones <lee@kernel.org>,
	Roderick Colenbrander <roderick.colenbrander@sony.com>,
	Sven Eckelmann <sven@narfation.org>
Subject: [PATCH v2 4/5] HID: dualshock4_remove: manually unregister leds
Date: Thu, 26 Jan 2023 12:11:42 +0000	[thread overview]
Message-ID: <20230125-hid-unregister-leds-v2-4-514437b19297@diag.uniroma1.it> (raw)
In-Reply-To: <CAEc3jaDRzvw4wqomWTZ4QiGT7ndm0u+LQuqDTOWB=B-6w=2yzg@mail.gmail.com>

Unregister the LED controllers before device removal, to prevent
unnecessary runs of dualshock4_led_set_brightness().

Fixes: 4521109a8f40 ("HID: playstation: support DualShock4 lightbar.")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>

---

Contrary to the other patches in this series, failing to unregister
the led controller does not results into a use-after-free thanks
to the output_worker_initialized variable and the spinlock checks.

Changes in v2:
- Clarify UAF
- Link to v1: https://lore.kernel.org/all/20230125-hid-unregister-leds-v1-4-9a5192dcef16@diag.uniroma1.it/
---
 drivers/hid/hid-playstation.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/hid/hid-playstation.c b/drivers/hid/hid-playstation.c
index f23186ca2d76..b41657842e26 100644
--- a/drivers/hid/hid-playstation.c
+++ b/drivers/hid/hid-playstation.c
@@ -2434,11 +2434,15 @@ static void dualshock4_remove(struct ps_device *ps_dev)
 {
 	struct dualshock4 *ds4 = container_of(ps_dev, struct dualshock4, base);
 	unsigned long flags;
+	int i;
 
 	spin_lock_irqsave(&ds4->base.lock, flags);
 	ds4->output_worker_initialized = false;
 	spin_unlock_irqrestore(&ds4->base.lock, flags);
 
+	for (i = 0; i < ARRAY_SIZE(ds4->lightbar_leds); i++)
+		devm_led_classdev_unregister(&ps_dev->hdev->dev, &ds4->lightbar_leds[i]);
+
 	cancel_work_sync(&ds4->output_worker);
 
 	if (ps_dev->hdev->product == USB_DEVICE_ID_SONY_PS4_CONTROLLER_DONGLE)

-- 
2.25.1

  parent reply	other threads:[~2023-01-26 12:12 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-01-26  0:24 [PATCH 0/5] HID: manually unregister leds on device removal to prevent UAFs Pietro Borrello
2023-01-26  0:24 ` [PATCH 1/5] HID: bigben_remove: manually unregister leds Pietro Borrello
2023-01-26  0:24 ` [PATCH 2/5] HID: asus_remove: manually unregister led Pietro Borrello
2023-01-26  0:24 ` [PATCH 3/5] HID: dualsense_remove: manually unregister leds Pietro Borrello
2023-01-26  0:43   ` Roderick Colenbrander
2023-01-26  0:47     ` Roderick Colenbrander
2023-01-26 12:09       ` [PATCH v2 " Pietro Borrello
2023-01-26 12:11       ` Pietro Borrello [this message]
2023-01-26  1:01     ` [PATCH " Pietro Borrello
2023-01-26  0:24 ` [PATCH 4/5] HID: dualshock4_remove: " Pietro Borrello
2023-01-26  0:24 ` [PATCH 5/5] HID: sony_remove: " Pietro Borrello
2023-01-26  8:32   ` Sven Eckelmann
2023-05-10 10:12 ` [PATCH 0/5] HID: manually unregister leds on device removal to prevent UAFs Donald Buczek
2023-05-10 10:59   ` Benjamin Tissoires
2023-05-10 11:41   ` Pavel Machek
2023-01-31 13:08 [PATCH v2 " Pietro Borrello
2023-01-31 13:08 ` [PATCH v2 4/5] HID: dualshock4_remove: manually unregister leds Pietro Borrello

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20230125-hid-unregister-leds-v2-4-514437b19297@diag.uniroma1.it \
    --to=borrello@diag.uniroma1.it \
    --cc=benjamin.tissoires@redhat.com \
    --cc=c.giuffrida@vu.nl \
    --cc=h.j.bos@vu.nl \
    --cc=jikos@kernel.org \
    --cc=jkl820.git@gmail.com \
    --cc=jkosina@suse.cz \
    --cc=kontakt@hanno.de \
    --cc=lee@kernel.org \
    --cc=linux-input@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-leds@vger.kernel.org \
    --cc=pavel@ucw.cz \
    --cc=roderick.colenbrander@sony.com \
    --cc=roderick@gaikai.com \
    --cc=sven@narfation.org \
    --cc=thunderbird2k@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.