diff mbox series

[4.9,34/88] HID: hiddev: Fix race in in hiddev_disconnect()

Message ID	20200310123614.195198369@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <SRS0=QSPG=43=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, syzbot+784ccb935f9900cc7c9e@syzkaller.appspotmail.com, Alan Stern <stern@rowland.harvard.edu>, Dan Carpenter <dan.carpenter@oracle.com>, Jiri Kosina <jkosina@suse.cz> Subject: [PATCH 4.9 34/88] HID: hiddev: Fix race in in hiddev_disconnect() Date: Tue, 10 Mar 2020 13:38:42 +0100 Message-Id: <20200310123614.195198369@linuxfoundation.org> In-Reply-To: <20200310123606.543939933@linuxfoundation.org> References: <20200310123606.543939933@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [4.9,04/88] ext4: fix potential race between s_group_info online resizing and access [4.9,07/88] mac80211: consider more elements in parsing CRC [4.9,08/88] cfg80211: check wiphy driver existence for drvinfo report [4.9,11/88] net: ena: add missing ethtool TX timestamping indication [4.9,13/88] net: ena: rss: fix failure to get indirection table [4.9,16/88] net: ena: ena-com.c: prevent NULL pointer dereference [4.9,18/88] cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE [4.9,19/88] sysrq: Restore original console_loglevel when sysrq disabled [4.9,21/88] net: fib_rules: Correctly set table field when table number exceeds 8 bits [4.9,22/88] net: phy: restore mdio regs in the iproc mdio driver [4.9,24/88] ipv6: Fix route replacement with dev-only route [4.9,27/88] net: sched: correct flower port blocking [4.9,28/88] ext4: potential crash on allocation error in ext4_alloc_flex_bg_array() [4.9,29/88] audit: fix error handling in audit_data_to_entry() [4.9,31/88] ACPI: watchdog: Fix gas->access_width usage [4.9,32/88] HID: core: fix off-by-one memset in hid_report_raw_event() [4.9,33/88] HID: core: increase HID report buffer size to 8KiB [4.9,34/88] HID: hiddev: Fix race in in hiddev_disconnect() [4.9,35/88] MIPS: VPE: Fix a double free and a memory leak in release_vpe() [4.9,38/88] serial: 8250: Check UPF_IRQ_SHARED in advance [4.9,39/88] include/linux/bitops.h: introduce BITS_PER_TYPE [4.9,40/88] net: netlink: cap max groups which will be considered in netlink_bind() [4.9,42/88] namei: only return -ECHILD from follow_dotdot_rcu() [4.9,44/88] slip: stop double free sl->dev in slip_open [4.9,46/88] drivers: net: xgene: Fix the order of the arguments of alloc_etherdev_mqs() [4.9,48/88] mm/huge_memory.c: use head to check huge zero page [4.9,49/88] audit: always check the netlink payload length in audit_receive_msg() [4.9,53/88] usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags [4.9,54/88] usb: gadget: serial: fix Tx stall after buffer overflow [4.9,56/88] drm/msm/dsi: save pll state before dsi host is powered off [4.9,57/88] net: ks8851-ml: Remove 8-bit bus accessors [4.9,60/88] watchdog: da9062: do not ping the hw during stop() [4.9,63/88] cifs: dont leak -EAGAIN for stat() during reconnect [4.9,65/88] usb: quirks: add NO_LPM quirk for Logitech Screen Share [4.9,67/88] usb: core: port: do error out if usb_autopm_get_interface() fails [4.9,71/88] vt: selection, close sel_buffer race [4.9,72/88] vt: selection, push console lock down [4.9,76/88] dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list [4.9,77/88] ARM: dts: ls1021a: Restore MDIO compatible to gianfar [4.9,79/88] ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path [4.9,80/88] ASoC: dapm: Correct DAPM handling of active widgets during shutdown [4.9,84/88] hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT() [4.9,86/88] powerpc: fix hardware PMU exception bug on PowerVM compatibility mode systems [4.9,88/88] crypto: algif_skcipher - use ZERO_OR_NULL_PTR in skcipher_recvmsg_async

Commit Message

Greg Kroah-Hartman March 10, 2020, 12:38 p.m. UTC

From: dan.carpenter@oracle.com <dan.carpenter@oracle.com>

commit 5c02c447eaeda29d3da121a2e17b97ccaf579b51 upstream.

Syzbot reports that "hiddev" is used after it's free in hiddev_disconnect().
The hiddev_disconnect() function sets "hiddev->exist = 0;" so
hiddev_release() can free it as soon as we drop the "existancelock"
lock.  This patch moves the mutex_unlock(&hiddev->existancelock) until
after we have finished using it.

Reported-by: syzbot+784ccb935f9900cc7c9e@syzkaller.appspotmail.com
Fixes: 7f77897ef2b6 ("HID: hiddev: fix potential use-after-free")
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hid/usbhid/hiddev.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff mbox series

Patch

--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -962,9 +962,9 @@  void hiddev_disconnect(struct hid_device
 	hiddev->exist = 0;
 
 	if (hiddev->open) {
-		mutex_unlock(&hiddev->existancelock);
 		usbhid_close(hiddev->hid);
 		wake_up_interruptible(&hiddev->wait);
+		mutex_unlock(&hiddev->existancelock);
 	} else {
 		mutex_unlock(&hiddev->existancelock);
 		kfree(hiddev);