Skip to contentSkip to conversation

HID: uclogic: Correct devm device reference for hidinput input_dev name

PATCH New [email protected] 1 participant 2 messages Feb 3 Stable branch

lore
Share & tools
lore

[email protected]

author
#0 lore raw

PATCH 1/2 HID: uclogic: Correct devm device reference for hidinput input_dev name

From: Rahul Rameshbabu <[email protected]>

[ Upstream commit dd613a4e45f8d35f49a63a2064e5308fa5619e29 ]

Reference the HID device rather than the input device for the devm allocation of the input_dev name. Referencing the input_dev would lead to a use-after-free when the input_dev was unregistered and subsequently fires a uevent that depends on the name. At the point of firing the uevent, the name would be freed by devres management.

Use devm_kasprintf to simplify the logic for allocating memory and formatting the input_dev name string.

Reported-by [email protected]
Closes https://lore.kernel.org/linux-input/ZOZIZCND+L0P1wJc@penguin/T/ open here
Reported-by Maxime Ripard <[email protected]>
Closes https://lore.kernel.org/linux-input/ZOZIZCND+L0P1wJc@penguin/T/#m443f3dce92520f74b6cf6ffa8653f9c92643d4ae open here
Fixes cce2dbdf258e ("HID: uclogic: name the input nodes based on their tool")
Suggested-by Maxime Ripard <[email protected]>
Suggested-by Dmitry Torokhov <[email protected]>
Signed-off-by Rahul Rameshbabu <[email protected]>
Reviewed-by Maxime Ripard <[email protected]>
Link https://lore.kernel.org/r/[email protected] open here
Signed-off-by Benjamin Tissoires <[email protected]>
[ Adjust context ]
Signed-off-by Wenshan Lan <[email protected]>
---
 drivers/hid/hid-uclogic-core.c | 13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)
drivers/hid/hid-uclogic-core.c +3 -10
index e4811d37ca77..02a3b2aa1bda 100644
@@ -104,10 +104,8 @@ static int uclogic_input_configured(struct hid_device *hdev,
 {
 	struct uclogic_drvdata *drvdata = hid_get_drvdata(hdev);
 	struct uclogic_params *params = &drvdata->params;
-	char *name;
 	const char *suffix = NULL;
 	struct hid_field *field;
-	size_t len;
 
 	/* no report associated (HID_QUIRK_MULTI_INPUT not set) */
 	if (!hi->report)

@@ -145,14 +143,9 @@ static int uclogic_input_configured(struct hid_device *hdev,
 		break;
 	}
 
-	if (suffix) {
-		len = strlen(hdev->name) + 2 + strlen(suffix);
-		name = devm_kzalloc(&hi->input->dev, len, GFP_KERNEL);
-		if (name) {
-			snprintf(name, len, "%s %s", hdev->name, suffix);
-			hi->input->name = name;
-		}
-	}
+	if (suffix)
+		hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL,
+						 "%s %s", hdev->name, suffix);
 
 	return 0;
 }
Signature · 1 line
2.43.0
author
#1 lore raw

PATCH 2/2 HID: uclogic: Add NULL check in uclogic_input_configured()

From: Henry Martin <[email protected]>

[ Upstream commit bd07f751208ba190f9b0db5e5b7f35d5bb4a8a1e ]

devm_kasprintf() returns NULL when memory allocation fails. Currently, uclogic_input_configured() does not check for this case, which results in a NULL pointer dereference.

Add NULL check after devm_kasprintf() to prevent this issue.

Fixes dd613a4e45f8 ("HID: uclogic: Correct devm device reference for hidinput input_dev name")
Signed-off-by Henry Martin <[email protected]>
Signed-off-by Jiri Kosina <[email protected]>
[ Adjust context ]
Signed-off-by Wenshan Lan <[email protected]>
---
 drivers/hid/hid-uclogic-core.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/hid/hid-uclogic-core.c +4 -1
index 02a3b2aa1bda..c0d56b7ca19e 100644
@@ -143,9 +143,12 @@ static int uclogic_input_configured(struct hid_device *hdev,
 		break;
 	}
 
-	if (suffix)
+	if (suffix) {
 		hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL,
 						 "%s %s", hdev->name, suffix);
+		if (!hi->input->name)
+			return -ENOMEM;
+	}
 
 	return 0;
 }
Signature · 1 line
2.43.0