linux

mirror of https://github.com/FEX-Emu/linux.git synced 2025-01-17 15:08:54 +00:00

History

Valentine Barshak 1a8e8fab79 HID: Fix race between disconnect and hiddev_ioctl

A USB HID device can be disconnected at any time.
If this happens right before or while hiddev_ioctl is in progress,
the hiddev_ioctl tries to access invalid hiddev->hid pointer.
When the hid device is disconnected, the hiddev_disconnect()
ends up with a call to hid_device_release() which frees
hid_device, but doesn't set the hiddev->hid pointer to NULL.
If the deallocated memory region has been re-used by the kernel,
this can cause a crash or memory corruption.

Since disconnect can happen at any time, we can't initialize
struct hid_device *hid = hiddev->hid at the beginning of ioctl
and then use it.

This change checks hiddev->exist flag while holding
the existancelock and uses hid_device only if it exists.

Signed-off-by: Valentine Barshak <vbarshak@mvista.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

2010-12-07 15:45:49 +01:00

hid-core.c

Merge branches '3m', 'egalax', 'logitech', 'magicmouse', 'ntrig' and 'roccat' into for-linus

2010-10-23 22:47:38 +02:00

hid-pidff.c

include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h

2010-03-30 22:02:32 +09:00

hid-quirks.c

HID: Add support for Perixx PERIBOARD-707 (Plus)

2010-11-25 15:59:02 +01:00

hiddev.c

HID: Fix race between disconnect and hiddev_ioctl