HID: hidraw: fix data race on device refcount
authorLudvig Michaelsson <ludvig.michaelsson@yubico.com>
Wed, 21 Jun 2023 11:17:43 +0000 (13:17 +0200)
committerBenjamin Tissoires <benjamin.tissoires@redhat.com>
Wed, 21 Jun 2023 15:15:48 +0000 (17:15 +0200)
commit944ee77dc6ec7b0afd8ec70ffc418b238c92f12b
treeb8e3d37f27d397206bb7b666befa0a5689818638
parent4982126e3029cd59fbd1da0d9cc0365a0585fe64
HID: hidraw: fix data race on device refcount

The hidraw_open() function increments the hidraw device reference
counter. The counter has no dedicated synchronization mechanism,
resulting in a potential data race when concurrently opening a device.

The race is a regression introduced by commit 8590222e4b02 ("HID:
hidraw: Replace hidraw device table mutex with a rwsem"). While
minors_rwsem is intended to protect the hidraw_table itself, by instead
acquiring the lock for writing, the reference counter is also protected.
This is symmetrical to hidraw_release().

Link: https://github.com/systemd/systemd/issues/27947
Fixes: 8590222e4b02 ("HID: hidraw: Replace hidraw device table mutex with a rwsem")
Cc: stable@vger.kernel.org
Signed-off-by: Ludvig Michaelsson <ludvig.michaelsson@yubico.com>
Link: https://lore.kernel.org/r/20230621-hidraw-race-v1-1-a58e6ac69bab@yubico.com
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
drivers/hid/hidraw.c