linux-stable/drivers/hid
Charles Yi b14f26285a HID: fix HID device resource race between HID core and debugging support
[ Upstream commit fc43e9c857 ]

hid_debug_events_release releases resources bound to the HID device instance.
hid_device_release releases the underlying HID device instance potentially
before hid_debug_events_release has completed releasing debug resources bound
to the same HID device instance.

Reference count to prevent the HID device instance from being torn down
preemptively when HID debugging support is used. When count reaches zero,
release core resources of HID device instance using hiddev_free.

The crash:

[  120.728477][ T4396] kernel BUG at lib/list_debug.c:53!
[  120.728505][ T4396] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
[  120.739806][ T4396] Modules linked in: bcmdhd dhd_static_buf 8822cu pcie_mhi r8168
[  120.747386][ T4396] CPU: 1 PID: 4396 Comm: hidt_bridge Not tainted 5.10.110 #257
[  120.754771][ T4396] Hardware name: Rockchip RK3588 EVB4 LP4 V10 Board (DT)
[  120.761643][ T4396] pstate: 60400089 (nZCv daIf +PAN -UAO -TCO BTYPE=--)
[  120.768338][ T4396] pc : __list_del_entry_valid+0x98/0xac
[  120.773730][ T4396] lr : __list_del_entry_valid+0x98/0xac
[  120.779120][ T4396] sp : ffffffc01e62bb60
[  120.783126][ T4396] x29: ffffffc01e62bb60 x28: ffffff818ce3a200
[  120.789126][ T4396] x27: 0000000000000009 x26: 0000000000980000
[  120.795126][ T4396] x25: ffffffc012431000 x24: ffffff802c6d4e00
[  120.801125][ T4396] x23: ffffff8005c66f00 x22: ffffffc01183b5b8
[  120.807125][ T4396] x21: ffffff819df2f100 x20: 0000000000000000
[  120.813124][ T4396] x19: ffffff802c3f0700 x18: ffffffc01d2cd058
[  120.819124][ T4396] x17: 0000000000000000 x16: 0000000000000000
[  120.825124][ T4396] x15: 0000000000000004 x14: 0000000000003fff
[  120.831123][ T4396] x13: ffffffc012085588 x12: 0000000000000003
[  120.837123][ T4396] x11: 00000000ffffbfff x10: 0000000000000003
[  120.843123][ T4396] x9 : 455103d46b329300 x8 : 455103d46b329300
[  120.849124][ T4396] x7 : 74707572726f6320 x6 : ffffffc0124b8cb5
[  120.855124][ T4396] x5 : ffffffffffffffff x4 : 0000000000000000
[  120.861123][ T4396] x3 : ffffffc011cf4f90 x2 : ffffff81fee7b948
[  120.867122][ T4396] x1 : ffffffc011cf4f90 x0 : 0000000000000054
[  120.873122][ T4396] Call trace:
[  120.876259][ T4396]  __list_del_entry_valid+0x98/0xac
[  120.881304][ T4396]  hid_debug_events_release+0x48/0x12c
[  120.886617][ T4396]  full_proxy_release+0x50/0xbc
[  120.891323][ T4396]  __fput+0xdc/0x238
[  120.895075][ T4396]  ____fput+0x14/0x24
[  120.898911][ T4396]  task_work_run+0x90/0x148
[  120.903268][ T4396]  do_exit+0x1bc/0x8a4
[  120.907193][ T4396]  do_group_exit+0x8c/0xa4
[  120.911458][ T4396]  get_signal+0x468/0x744
[  120.915643][ T4396]  do_signal+0x84/0x280
[  120.919650][ T4396]  do_notify_resume+0xd0/0x218
[  120.924262][ T4396]  work_pending+0xc/0x3f0

[ Rahul Rameshbabu <sergeantsagara@protonmail.com>: rework changelog ]
Fixes: cd667ce247 ("HID: use debugfs for events/reports dumping")
Signed-off-by: Charles Yi <be286@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-12-08 08:43:23 +01:00
..
i2c-hid HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports 2022-04-15 14:14:48 +02:00
intel-ish-hid HID: intel_ish-hid: Add check for ishtp_dma_tx_map 2023-02-06 07:49:37 +01:00
usbhid HID: usbhid: free raw_report buffers in usbhid_stop 2021-10-06 15:31:28 +02:00
hid-a4tech.c HID: input: fix a4tech horizontal wheel custom usage 2019-08-29 08:28:40 +02:00
hid-accutouch.c
hid-alps.c HID: alps: Declare U1_UNICORN_LEGACY support 2022-08-25 11:15:18 +02:00
hid-apple.c HID: apple: Do not reset quirks when the Fn key is not found 2022-01-27 09:04:23 +01:00
hid-appleir.c
hid-asus.c HID: asus: use spinlock to safely schedule workers 2023-03-11 16:31:31 +01:00
hid-aureal.c
hid-axff.c HID: Fix assumption that devices have inputs 2019-11-06 13:06:18 +01:00
hid-belkin.c
hid-betopff.c HID: betop: check shape of output reports 2023-02-06 07:49:39 +01:00
hid-cherry.c
hid-chicony.c HID: check for valid USB device for many HID drivers 2021-12-14 10:18:04 +01:00
hid-cmedia.c
hid-core.c HID: fix HID device resource race between HID core and debugging support 2023-12-08 08:43:23 +01:00
hid-corsair.c HID: check for valid USB device for many HID drivers 2021-12-14 10:18:04 +01:00
hid-cougar.c
hid-cp2112.c hid: cp2112: Fix duplicate workqueue initialization 2023-11-20 10:29:19 +01:00
hid-cypress.c HID: cypress: Support Varmilo Keyboards' media hotkeys 2020-12-02 08:48:08 +01:00
hid-debug.c HID: fix HID device resource race between HID core and debugging support 2023-12-08 08:43:23 +01:00
hid-dr.c HID: Fix assumption that devices have inputs 2019-11-06 13:06:18 +01:00
hid-elan.c HID: elan: Fix potential double free in elan_input_configured 2022-06-14 16:59:20 +02:00
hid-elecom.c
hid-elo.c HID: check for valid USB device for many HID drivers 2021-12-14 10:18:04 +01:00
hid-emsff.c HID: Fix assumption that devices have inputs 2019-11-06 13:06:18 +01:00
hid-ezkey.c
hid-gaff.c HID: Fix assumption that devices have inputs 2019-11-06 13:06:18 +01:00
hid-gembird.c
hid-generic.c
hid-gfrm.c
hid-google-hammer.c HID: google: add jewel USB id 2023-06-09 10:24:01 +02:00
hid-gt683r.c HID: gt683r: add missing MODULE_DEVICE_TABLE 2021-06-30 08:48:11 -04:00
hid-gyration.c
hid-holtek-kbd.c HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event 2023-10-25 11:16:55 +02:00
hid-holtek-mouse.c HID: holtek: fix mouse probing 2021-12-29 12:20:43 +01:00
hid-holtekff.c HID: Fix assumption that devices have inputs 2019-11-06 13:06:18 +01:00
hid-hyperv.c HID: hyperv: fix possible memory leak in mousevsc_probe() 2022-11-25 17:40:16 +01:00
hid-icade.c
hid-ids.h HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W 2023-11-28 16:46:32 +00:00
hid-input.c HID: add mapping for KEY_ALL_APPLICATIONS 2022-03-08 19:04:09 +01:00
hid-ite.c HID: ite: Only bind to keyboard USB interface on Acer SW5-012 keyboard dock 2020-03-05 16:42:18 +01:00
hid-jabra.c
hid-kensington.c
hid-keytouch.c
hid-kye.c
hid-lcpower.c
hid-led.c HID: hid-led: fix maximum brightness for Dream Cheeky 2022-06-14 16:59:20 +02:00
hid-lenovo.c
hid-lg.c HID: check for valid USB device for many HID drivers 2021-12-14 10:18:04 +01:00
hid-lg.h
hid-lg2ff.c HID: Fix assumption that devices have inputs 2019-11-06 13:06:18 +01:00
hid-lg3ff.c HID: Fix assumption that devices have inputs 2019-11-06 13:06:18 +01:00
hid-lg4ff.c HID: hid-lg4ff: Add check for empty lbuf 2022-12-14 11:28:27 +01:00
hid-lg4ff.h
hid-lgff.c HID: Fix assumption that devices have inputs 2019-11-06 13:06:18 +01:00
hid-logitech-dj.c
hid-logitech-hidpp.c HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect 2023-10-25 11:16:20 +02:00
hid-magicmouse.c HID: magicmouse: Do not set BTN_MOUSE on double report 2022-11-03 23:52:26 +09:00
hid-mf.c HID: mf: add support for 0079:1846 Mayflash/Dragonrise USB Gamecube Adapter 2021-03-11 14:05:01 +01:00
hid-microsoft.c
hid-monterey.c
hid-multitouch.c HID: multitouch: Correct devm device reference for hidinput input_dev name 2023-09-23 10:48:09 +02:00
hid-nti.c
hid-ntrig.c
hid-ortek.c
hid-penmount.c
hid-petalynx.c
hid-picolcd.h
hid-picolcd_backlight.c
hid-picolcd_cir.c
hid-picolcd_core.c
hid-picolcd_debugfs.c
hid-picolcd_fb.c
hid-picolcd_lcd.c
hid-picolcd_leds.c
hid-pl.c
hid-plantronics.c HID: plantronics: Additional PIDs for double volume key presses quirk 2023-01-18 11:30:40 +01:00
hid-primax.c
hid-prodikeys.c HID: check for valid USB device for many HID drivers 2021-12-14 10:18:04 +01:00
hid-quirks.c HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W 2023-11-28 16:46:32 +00:00
hid-redragon.c
hid-retrode.c
hid-rmi.c HID: rmi: Check that the RMI_STARTED bit is set before unregistering the RMI transport device 2020-01-04 19:13:00 +01:00
hid-roccat-arvo.c HID: check for valid USB device for many HID drivers 2021-12-14 10:18:04 +01:00
hid-roccat-arvo.h
hid-roccat-common.c
hid-roccat-common.h
hid-roccat-isku.c HID: check for valid USB device for many HID drivers 2021-12-14 10:18:04 +01:00
hid-roccat-isku.h
hid-roccat-kone.c HID: check for valid USB device for many HID drivers 2021-12-14 10:18:04 +01:00
hid-roccat-kone.h
hid-roccat-koneplus.c HID: check for valid USB device for many HID drivers 2021-12-14 10:18:04 +01:00
hid-roccat-koneplus.h
hid-roccat-konepure.c HID: check for valid USB device for many HID drivers 2021-12-14 10:18:04 +01:00
hid-roccat-kovaplus.c HID: check for valid USB device for many HID drivers 2021-12-14 10:18:04 +01:00
hid-roccat-kovaplus.h
hid-roccat-lua.c HID: check for valid USB device for many HID drivers 2021-12-14 10:18:04 +01:00
hid-roccat-lua.h
hid-roccat-pyra.c HID: check for valid USB device for many HID drivers 2021-12-14 10:18:04 +01:00
hid-roccat-pyra.h
hid-roccat-ryos.c HID: check for valid USB device for many HID drivers 2021-12-14 10:18:04 +01:00
hid-roccat-savu.c HID: check for valid USB device for many HID drivers 2021-12-14 10:18:04 +01:00
hid-roccat-savu.h
hid-roccat.c HID: roccat: Fix use-after-free in roccat_read() 2022-10-26 13:19:41 +02:00
hid-saitek.c HID: saitek: add madcatz variant of MMO7 mouse device ID 2022-11-10 17:46:54 +01:00
hid-samsung.c HID: check for valid USB device for many HID drivers 2021-12-14 10:18:04 +01:00
hid-sensor-custom.c HID: hid-sensor-custom: set fixed size for custom attributes 2023-01-18 11:30:12 +01:00
hid-sensor-hub.c HID: hid-sensor-hub: Return error for hid_set_field() failure 2021-06-30 08:48:10 -04:00
hid-sjoy.c
hid-sony.c HID: sony: Fix for broken buttons on DS3 USB dongles 2020-06-07 13:17:53 +02:00
hid-speedlink.c
hid-steam.c HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report 2022-09-05 10:26:33 +02:00
hid-steelseries.c
hid-sunplus.c
hid-tivo.c
hid-tmff.c HID: Fix assumption that devices have inputs 2019-11-06 13:06:18 +01:00
hid-topseed.c
hid-twinhan.c
hid-uclogic.c HID: check for valid USB device for many HID drivers 2021-12-14 10:18:04 +01:00
hid-udraw-ps3.c
hid-waltop.c
hid-wiimote-core.c
hid-wiimote-debug.c
hid-wiimote-modules.c
hid-wiimote.h
hid-xinmo.c
hid-zpff.c HID: Fix assumption that devices have inputs 2019-11-06 13:06:18 +01:00
hid-zydacron.c
hidraw.c HID: hidraw: fix memory leak in hidraw_release() 2022-09-05 10:26:33 +02:00
Kconfig HID: asus: Add depends on USB_HID to HID_ASUS Kconfig option 2022-01-05 12:34:57 +01:00
Makefile
uhid.c HID: uhid: Over-ride the default maximum data buffer value with our own 2023-03-22 13:27:12 +01:00
wacom.h HID: wacom: remove the battery when the EKR is off 2023-09-23 10:47:56 +02:00
wacom_sys.c HID: wacom: remove the battery when the EKR is off 2023-09-23 10:47:56 +02:00
wacom_wac.c HID: wacom: remove the battery when the EKR is off 2023-09-23 10:47:56 +02:00
wacom_wac.h HID: wacom: remove the battery when the EKR is off 2023-09-23 10:47:56 +02:00