USB HID: Protect against disconnect/NULL-dereference race
A message that is not in the archive (sent off-list or not yet received): [email protected]
PATCH RESEND 1/1 USB HID: Protect against disconnect/NULL-dereference race
One of our users reports consistently hitting a NULL dereference that resolves to the "hid_to_usb_dev(hid);" call in hiddev_ioctl(), when disconnecting a Lego WeDo USB HID device from an OLPC XO running Scratch software. There's a FIXME comment and a guard against the dereference, but that happens farther down the function than the initial dereference does.
This patch moves the call to be below the guard, and the user reports that it fixes the problem for him. OLPC bug report:
http://dev.laptop.org/ticket/10174
--- drivers/hid/usbhid/hiddev.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-)
drivers/hid/usbhid/hiddev.c +4 -2
@@ -593,7 +593,7 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)struct hiddev_list *list = file->private_data;struct hiddev *hiddev = list->hiddev;struct hid_device *hid = hiddev->hid; -struct usb_device *dev =hid_to_usb_dev (hid); +struct usb_device *dev;struct hiddev_collection_info cinfo;struct hiddev_report_info rinfo;struct hiddev_field_info finfo;
@@ -607,9 +607,11 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)/* Called without BKL by compat methods so no BKL taken */ /* FIXME: Who or what stop this racing with a disconnect ?? */ -if (!hiddev->exist) +if (!hiddev->exist || !hid)return -EIO ; + dev =hid_to_usb_dev (hid); +switch (cmd) {case HIDIOCGVERSION :
Signature · 5 lines
1.7.0.1 -- Chris Ball <[email protected]> One Laptop Per Child
A message that is not in the archive (sent off-list or not yet received): [email protected]
Hi ,
i am also using HIDDEV interface . and i also got hiddev_ioctl NULL dereference problem .
Below patch fixes my problem .
Regards
Amit Nagal
Quoted 45 lines · Chris Ball
One of our users reports consistently hitting a NULL dereference that resolves to the "
hid_to_usb_dev(hid);" call inhiddev_ioctl(), when disconnecting a Lego WeDo USB HID device from an OLPC XO running Scratch software. There's a FIXME comment and a guard against the dereference, but that happens farther down the function than the initial dereference does.This patch moves the call to be below the guard, and the user reports that it fixes the problem for him. OLPC bug report:
http://dev.laptop.org/ticket/10174Signed-off-by Chris Ball <[email protected]>---
drivers/hid/usbhid/hiddev.c | 6 ++++--1 files changed, 4 insertions(+), 2 deletions(-)drivers/hid/usbhid/hiddev.c +4
-2@@ -593,7 +593,7 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) struct hiddev_list *list = file->private_data; struct hiddev *hiddev = list->hiddev; struct hid_device *hid = hiddev->hid; - struct usb_device *dev = hid_to_usb_dev(hid); + struct usb_device *dev; struct hiddev_collection_info cinfo; struct hiddev_report_info rinfo; struct hiddev_field_info finfo;@@ -607,9 +607,11 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) /* Called without BKL by compat methods so no BKL taken */ /* FIXME: Who or what stop this racing with a disconnect ?? */ - if (!hiddev->exist) + if (!hiddev->exist || !hid) return -EIO; + dev = hid_to_usb_dev(hid); + switch (cmd) {case HIDIOCGVERSION:
--
1.7.0.1
Quoted 8 lines
--
Chris Ball <[email protected]>
One Laptop Per Child
--
To unsubscribe from this list: send the line "unsubscribe linux-input" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
Jiri Kosina
AppliedQuoted 7 lines · Chris Ball
One of our users reports consistently hitting a NULL dereference that resolves to the "
hid_to_usb_dev(hid);" call inhiddev_ioctl(), when disconnecting a Lego WeDo USB HID device from an OLPC XO running Scratch software. There's a FIXME comment and a guard against the dereference, but that happens farther down the function than the initial dereference does.
Quoted 5 lines
This patch moves the call to be below the guard, and the user reports that it fixes the problem for him. OLPC bug report:
http://dev.laptop.org/ticket/10174Signed-off-by Chris Ball <[email protected]>
Applied, thanks Chris.
Signature · 6 lines
Jiri Kosina SUSE Labs, Novell Inc. -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html