Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9c9e54a8 authored by Jiri Kosina's avatar Jiri Kosina
Browse files

HID: hiddev: fix memory corruption due to invalid intfdata 



Commit bd25f4dd ("HID: hiddev: use usb_find_interface,
get rid of BKL") introduced using of private intfdata in hiddev for
purpose of storing hiddev pointer.

This is a problem, because intf pointer is already being set to struct
hid_device pointer by HID core. This obviously lead to memory corruptions
at device disconnect time, such as

WARNING: at lib/kobject.c:595 kobject_put+0x37/0x4b()
kobject: '(null)' (ffff88011e9cd898): is not initialized, yet kobject_put() is being called.

Convert hiddev into accessing hiddev through struct hid_device which is
in intfdata already.

Reported-and-tested-by: default avatarMarkus Trippelsdorf <markus@trippelsdorf.de>
Reported-and-tested-by: default avatarHeinz Diehl <htd@fritha.org>
Reported-and-tested-by: default avatarAlan Ott <alan@signal11.us>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent 7032269e

drivers/hid/usbhid/hiddev.c

+3 −2
Original line number Original line Diff line number Diff line
@@ -266,13 +266,15 @@ static int hiddev_open(struct inode *inode, struct file *file) 
{

{

	struct hiddev_list *list;

	struct hiddev_list *list;

	struct usb_interface *intf;

	struct usb_interface *intf;

	struct hid_device *hid;

	struct hiddev *hiddev;

	struct hiddev *hiddev;

	int res;

	int res;





	intf = usb_find_interface(&hiddev_driver, iminor(inode));

	intf = usb_find_interface(&hiddev_driver, iminor(inode));

	if (!intf)

	if (!intf)

		return -ENODEV;

		return -ENODEV;

	hiddev = usb_get_intfdata(intf);

	hid = usb_get_intfdata(intf);

	hiddev = hid->hiddev;





	if (!(list = kzalloc(sizeof(struct hiddev_list), GFP_KERNEL)))

	if (!(list = kzalloc(sizeof(struct hiddev_list), GFP_KERNEL)))

		return -ENOMEM;

		return -ENOMEM;
@@ -890,7 +892,6 @@ int hiddev_connect(struct hid_device *hid, unsigned int force) 
	hid->hiddev = hiddev;

	hid->hiddev = hiddev;

	hiddev->hid = hid;

	hiddev->hid = hid;

	hiddev->exist = 1;

	hiddev->exist = 1;

	usb_set_intfdata(usbhid->intf, usbhid);

	retval = usb_register_dev(usbhid->intf, &hiddev_class);

	retval = usb_register_dev(usbhid->intf, &hiddev_class);

	if (retval) {

	if (retval) {

		err_hid("Not able to get a minor for this device.");

		err_hid("Not able to get a minor for this device.");