All of lore.kernel.org
 help / color / mirror / Atom feed
From: Hanno Zulla <abos@hanno.de>
To: Jiri Kosina <jikos@kernel.org>,
	Benjamin Tissoires <benjamin.tissoires@redhat.com>,
	linux-input@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH 0/3] HID: hid-bigbenff: fixing three crash bugs in a gamepad driver
Date: Mon, 17 Feb 2020 16:24:41 +0100	[thread overview]
Message-ID: <ae5eee33-9dfc-0609-1bf8-33fd773b9bd5@hanno.de> (raw)

Hi there,

the hid-bigbenff.c had three bugs causing possible kernel crashes.

The first patch fixes a double free during device removal, which was 
caused by a wrong use of input_ff_create_memless(). The 
"driver-specific data to be passed into play_effect" parameter of 
input_ff_create_memless() would later be freed automatically when the ff 
device is removed. Since the driver also uses the managed resource API, 
it would automatically free the memory of this parameter twice, causing 
a general protection fault moments later.

The second patch fixes the error path after hid_hw_start(), as a call 
to hid_hw_stop() is required in case of an error.

The second patch also removes the hid_hw_close() call during device 
removal, as several other hid device drivers don't call this routine, 
either.

The third patch adds a flag to avoid a race condition when there is 
still scheduled work left (or newly being scheduled) during or after 
device removal, which could cause a kernel crash.

Thanks in advance for your review & kind regards,

Hanno

             reply	other threads:[~2020-02-17 15:44 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-02-17 15:24 Hanno Zulla [this message]
2020-02-17 15:25 ` [PATCH 1/3] HID: hid-bigbenff: fix general protection fault caused by double kfree Hanno Zulla
2020-02-17 15:26   ` [PATCH 2/3] HID: hid-bigbenff: call hid_hw_stop() in case of error Hanno Zulla
2020-02-17 15:27     ` [PATCH 3/3] HID: hid-bigbenff: fix race condition for scheduled work during removal Hanno Zulla
2020-02-18 10:40 ` [PATCH 0/3] HID: hid-bigbenff: fixing three crash bugs in a gamepad driver Benjamin Tissoires
2020-02-18 11:30   ` [PATCH v2 " Hanno Zulla
2020-02-18 11:37     ` [PATCH v2 1/3] HID: hid-bigbenff: fix general protection fault caused by double kfree Hanno Zulla
2020-02-18 11:38       ` [PATCH v2 2/3] HID: hid-bigbenff: call hid_hw_stop() in case of error Hanno Zulla
2020-02-18 11:39         ` [PATCH v2 3/3] HID: hid-bigbenff: fix race condition for scheduled work during removal Hanno Zulla
2020-02-19  7:54     ` [PATCH v2 0/3] HID: hid-bigbenff: fixing three crash bugs in a gamepad driver Benjamin Tissoires

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=ae5eee33-9dfc-0609-1bf8-33fd773b9bd5@hanno.de \
    --to=abos@hanno.de \
    --cc=benjamin.tissoires@redhat.com \
    --cc=jikos@kernel.org \
    --cc=linux-input@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.