]> git.baikalelectronics.ru Git - kernel.git/commit
HID: hiddev: Fix race in in hiddev_disconnect()
authordan.carpenter@oracle.com <dan.carpenter@oracle.com>
Wed, 15 Jan 2020 17:46:28 +0000 (20:46 +0300)
committerJiri Kosina <jkosina@suse.cz>
Wed, 12 Feb 2020 13:46:56 +0000 (14:46 +0100)
commit2ce1f2f5290045d825b619cd086f6cfb4b42fab6
tree02a1c1bedb8f91014706175750a496fddb508bfe
parentcd42edb492f476fb4b8b09aa3402a393d4a3e555
HID: hiddev: Fix race in in hiddev_disconnect()

Syzbot reports that "hiddev" is used after it's free in hiddev_disconnect().
The hiddev_disconnect() function sets "hiddev->exist = 0;" so
hiddev_release() can free it as soon as we drop the "existancelock"
lock.  This patch moves the mutex_unlock(&hiddev->existancelock) until
after we have finished using it.

Reported-by: syzbot+784ccb935f9900cc7c9e@syzkaller.appspotmail.com
Fixes: e529c144edf1 ("HID: hiddev: fix potential use-after-free")
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
drivers/hid/usbhid/hiddev.c