Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2f4052ff authored by He, Bo's avatar He, Bo Committed by Greg Kroah-Hartman
Browse files

HID: debug: fix race condition with between rdesc_show() and device removal 



[ Upstream commit cef0d4948cb0a02db37ebfdc320e127c77ab1637 ]

There is a race condition that could happen if hid_debug_rdesc_show()
is running while hdev is in the process of going away (device removal,
system suspend, etc) which could result in NULL pointer dereference:

	 BUG: unable to handle kernel paging request at 0000000783316040
	 CPU: 1 PID: 1512 Comm: getevent Tainted: G     U     O 4.19.20-quilt-2e5dc0ac-00029-gc455a447dd55 #1
	 RIP: 0010:hid_dump_device+0x9b/0x160
	 Call Trace:
	  hid_debug_rdesc_show+0x72/0x1d0
	  seq_read+0xe0/0x410
	  full_proxy_read+0x5f/0x90
	  __vfs_read+0x3a/0x170
	  vfs_read+0xa0/0x150
	  ksys_read+0x58/0xc0
	  __x64_sys_read+0x1a/0x20
	  do_syscall_64+0x55/0x110
	  entry_SYSCALL_64_after_hwframe+0x49/0xbe

Grab driver_input_lock to make sure the input device exists throughout the
whole process of dumping the rdesc.

[jkosina@suse.cz: update changelog a bit]
Signed-off-by: default avatarhe, bo <bo.he@intel.com>
Signed-off-by: default avatar"Zhang, Jun" <jun.zhang@intel.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 61effc64

drivers/hid/hid-debug.c

+5 −0
Original line number Diff line number Diff line
@@ -1060,10 +1060,15 @@ static int hid_debug_rdesc_show(struct seq_file *f, void *p) 
	seq_printf(f, "\n\n");



	/* dump parsed data and input mappings */

	if (down_interruptible(&hdev->driver_input_lock))

		return 0;



	hid_dump_device(hdev, f);

	seq_printf(f, "\n");

	hid_dump_input_mapping(hdev, f);



	up(&hdev->driver_input_lock);



	return 0;

}