| From 5245d436b6134e3c8d51552d13f279fcc7884348 Mon Sep 17 00:00:00 2001 |
| From: "He, Bo" <bo.he@intel.com> |
| Date: Thu, 14 Mar 2019 02:28:21 +0000 |
| Subject: HID: debug: fix race condition with between rdesc_show() and device |
| removal |
| |
| [ Upstream commit cef0d4948cb0a02db37ebfdc320e127c77ab1637 ] |
| |
| There is a race condition that could happen if hid_debug_rdesc_show() |
| is running while hdev is in the process of going away (device removal, |
| system suspend, etc) which could result in NULL pointer dereference: |
| |
| BUG: unable to handle kernel paging request at 0000000783316040 |
| CPU: 1 PID: 1512 Comm: getevent Tainted: G U O 4.19.20-quilt-2e5dc0ac-00029-gc455a447dd55 #1 |
| RIP: 0010:hid_dump_device+0x9b/0x160 |
| Call Trace: |
| hid_debug_rdesc_show+0x72/0x1d0 |
| seq_read+0xe0/0x410 |
| full_proxy_read+0x5f/0x90 |
| __vfs_read+0x3a/0x170 |
| vfs_read+0xa0/0x150 |
| ksys_read+0x58/0xc0 |
| __x64_sys_read+0x1a/0x20 |
| do_syscall_64+0x55/0x110 |
| entry_SYSCALL_64_after_hwframe+0x49/0xbe |
| |
| Grab driver_input_lock to make sure the input device exists throughout the |
| whole process of dumping the rdesc. |
| |
| [jkosina@suse.cz: update changelog a bit] |
| Signed-off-by: he, bo <bo.he@intel.com> |
| Signed-off-by: "Zhang, Jun" <jun.zhang@intel.com> |
| Signed-off-by: Jiri Kosina <jkosina@suse.cz> |
| Signed-off-by: Sasha Levin (Microsoft) <sashal@kernel.org> |
| --- |
| drivers/hid/hid-debug.c | 5 +++++ |
| 1 file changed, 5 insertions(+) |
| |
| diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c |
| index ac9fda1b5a72..1384e57182af 100644 |
| --- a/drivers/hid/hid-debug.c |
| +++ b/drivers/hid/hid-debug.c |
| @@ -1060,10 +1060,15 @@ static int hid_debug_rdesc_show(struct seq_file *f, void *p) |
| seq_printf(f, "\n\n"); |
| |
| /* dump parsed data and input mappings */ |
| + if (down_interruptible(&hdev->driver_input_lock)) |
| + return 0; |
| + |
| hid_dump_device(hdev, f); |
| seq_printf(f, "\n"); |
| hid_dump_input_mapping(hdev, f); |
| |
| + up(&hdev->driver_input_lock); |
| + |
| return 0; |
| } |
| |
| -- |
| 2.20.1 |
| |