HID: uhid: Fix worker destroying device without any protection
authorJann Horn <jannh@google.com>
Fri, 14 Jan 2022 13:33:30 +0000 (14:33 +0100)
committerJiri Kosina <jkosina@suse.cz>
Wed, 19 Jan 2022 14:59:05 +0000 (15:59 +0100)
commit4ea5763fb79ed89b3bdad455ebf3f33416a81624
tree0b0dcbdef3fa8d32b09e9a99c03729cb58eb7013
parente24aeff6db738be7ce24999a41e91299b5fe14be
HID: uhid: Fix worker destroying device without any protection

uhid has to run hid_add_device() from workqueue context while allowing
parallel use of the userspace API (which is protected with ->devlock).
But hid_add_device() can fail. Currently, that is handled by immediately
destroying the associated HID device, without using ->devlock - but if
there are concurrent requests from userspace, that's wrong and leads to
NULL dereferences and/or memory corruption (via use-after-free).

Fix it by leaving the HID device as-is in the worker. We can clean it up
later, either in the UHID_DESTROY command handler or in the ->release()
handler.

Cc: stable@vger.kernel.org
Fixes: 67f8ecc550b5 ("HID: uhid: fix timeout when probe races with IO")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
drivers/hid/uhid.c