OSDN Git Service

HID: debug: fix race condition with between rdesc_show() and device removal
authorHe, Bo <bo.he@intel.com>
Thu, 14 Mar 2019 02:28:21 +0000 (02:28 +0000)
committerJiri Kosina <jkosina@suse.cz>
Tue, 19 Mar 2019 14:41:08 +0000 (15:41 +0100)
commitcef0d4948cb0a02db37ebfdc320e127c77ab1637
treea6dd022b559573e75c2df7ef780fd4ddc0b77c55
parent6c44b15e1c9076d925d5236ddadf1318b0a25ce2
HID: debug: fix race condition with between rdesc_show() and device removal

There is a race condition that could happen if hid_debug_rdesc_show()
is running while hdev is in the process of going away (device removal,
system suspend, etc) which could result in NULL pointer dereference:

 BUG: unable to handle kernel paging request at 0000000783316040
 CPU: 1 PID: 1512 Comm: getevent Tainted: G     U     O 4.19.20-quilt-2e5dc0ac-00029-gc455a447dd55 #1
 RIP: 0010:hid_dump_device+0x9b/0x160
 Call Trace:
  hid_debug_rdesc_show+0x72/0x1d0
  seq_read+0xe0/0x410
  full_proxy_read+0x5f/0x90
  __vfs_read+0x3a/0x170
  vfs_read+0xa0/0x150
  ksys_read+0x58/0xc0
  __x64_sys_read+0x1a/0x20
  do_syscall_64+0x55/0x110
  entry_SYSCALL_64_after_hwframe+0x49/0xbe

Grab driver_input_lock to make sure the input device exists throughout the
whole process of dumping the rdesc.

[jkosina@suse.cz: update changelog a bit]
Signed-off-by: he, bo <bo.he@intel.com>
Signed-off-by: "Zhang, Jun" <jun.zhang@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
drivers/hid/hid-debug.c