diff options
| author | He, Bo <bo.he@intel.com> | 2019-03-14 03:28:21 +0100 |
|---|---|---|
| committer | Jiri Kosina <jkosina@suse.cz> | 2019-03-19 15:41:08 +0100 |
| commit | cef0d4948cb0a02db37ebfdc320e127c77ab1637 (patch) | |
| tree | a6dd022b559573e75c2df7ef780fd4ddc0b77c55 /drivers/hid | |
| parent | HID: logitech: check the return value of create_singlethread_workqueue (diff) | |
| download | linux-cef0d4948cb0a02db37ebfdc320e127c77ab1637.tar.xz linux-cef0d4948cb0a02db37ebfdc320e127c77ab1637.zip | |
HID: debug: fix race condition with between rdesc_show() and device removal
There is a race condition that could happen if hid_debug_rdesc_show()
is running while hdev is in the process of going away (device removal,
system suspend, etc) which could result in NULL pointer dereference:
BUG: unable to handle kernel paging request at 0000000783316040
CPU: 1 PID: 1512 Comm: getevent Tainted: G U O 4.19.20-quilt-2e5dc0ac-00029-gc455a447dd55 #1
RIP: 0010:hid_dump_device+0x9b/0x160
Call Trace:
hid_debug_rdesc_show+0x72/0x1d0
seq_read+0xe0/0x410
full_proxy_read+0x5f/0x90
__vfs_read+0x3a/0x170
vfs_read+0xa0/0x150
ksys_read+0x58/0xc0
__x64_sys_read+0x1a/0x20
do_syscall_64+0x55/0x110
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Grab driver_input_lock to make sure the input device exists throughout the
whole process of dumping the rdesc.
[jkosina@suse.cz: update changelog a bit]
Signed-off-by: he, bo <bo.he@intel.com>
Signed-off-by: "Zhang, Jun" <jun.zhang@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/hid')
| -rw-r--r-- | drivers/hid/hid-debug.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c index ac9fda1b5a72..1384e57182af 100644 --- a/drivers/hid/hid-debug.c +++ b/drivers/hid/hid-debug.c @@ -1060,10 +1060,15 @@ static int hid_debug_rdesc_show(struct seq_file *f, void *p) seq_printf(f, "\n\n"); /* dump parsed data and input mappings */ + if (down_interruptible(&hdev->driver_input_lock)) + return 0; + hid_dump_device(hdev, f); seq_printf(f, "\n"); hid_dump_input_mapping(hdev, f); + up(&hdev->driver_input_lock); + return 0; } |