diff options
| author | Yousef Alhouseen <alhouseenyousef@gmail.com> | 2026-06-29 17:29:47 +0200 |
|---|---|---|
| committer | Jiri Kosina <jkosina@suse.com> | 2026-09-11 17:02:36 +0200 |
| commit | 03f449b5de36a25fc5eba7dabf2b4494389bdb91 (patch) | |
| tree | 4db46aa7173d4fbbdfc39ddd9ab5b72863a592d2 /include/linux | |
| parent | 986c24e0fe44f844b44d365b71ce831947f50298 (diff) | |
| download | linux-next-03f449b5de36a25fc5eba7dabf2b4494389bdb91.tar.gz linux-next-03f449b5de36a25fc5eba7dabf2b4494389bdb91.zip | |
HID: hiddev: keep state alive through disconnect unlock
mutex_unlock() clears the mutex owner before taking its wait lock. A
thread spinning in the final hiddev file release can acquire
existancelock after hiddev_disconnect() clears the owner, then free
hiddev before the disconnecting thread reaches the mutex wait lock. This
causes a use-after-free in the mutex slow unlock path.
Give the connection and each open file an explicit reference. Drop each
reference only after its existancelock critical section has completed,
so neither unlock path can free the mutex while the other is still using
it.
Fixes: 079034073faf ("HID: hiddev cleanup -- handle all error conditions properly")
Reported-by: syzbot+563191a4939ddbfe73d4@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=563191a4939ddbfe73d4
Cc: stable@vger.kernel.org
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Link: https://syzkaller.appspot.com/bug?extid=563191a4939ddbfe73d4
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Diffstat (limited to 'include/linux')
| -rw-r--r-- | include/linux/hiddev.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/include/linux/hiddev.h b/include/linux/hiddev.h index 2164c03d2c72..8e9f8a33e359 100644 --- a/include/linux/hiddev.h +++ b/include/linux/hiddev.h @@ -13,6 +13,7 @@ #ifndef _HIDDEV_H #define _HIDDEV_H +#include <linux/refcount.h> #include <uapi/linux/hiddev.h> @@ -24,6 +25,7 @@ struct hiddev { int minor; int exist; int open; + refcount_t refcount; struct mutex existancelock; wait_queue_head_t wait; struct hid_device *hid; |