iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers/input/misc
History
Javier Carrasco 5aa514100a Input: powermate - fix use-after-free in powermate_config_complete 
commit 5c15c60e7be615f05a45cd905093a54b11f461bc upstream.

syzbot has found a use-after-free bug [1] in the powermate driver. This
happens when the device is disconnected, which leads to a memory free from
the powermate_device struct.  When an asynchronous control message
completes after the kfree and its callback is invoked, the lock does not
exist anymore and hence the bug.

Use usb_kill_urb() on pm->config to cancel any in-progress requests upon
device disconnection.

[1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e

Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Reported-by: syzbot+0434ac83f907a1dbdd1e@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20230916-topic-powermate_use_after_free-v3-1-64412b81a7a2@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-10-25 11:53:19 +02:00
..
88pm80x_onkey.c
Input: remove dev_err() usage after platform_get_irq()
2019-08-14 10:49:01 -07:00
88pm860x_onkey.c
Input: remove dev_err() usage after platform_get_irq()
2019-08-14 10:49:01 -07:00
ab8500-ponkey.c
Input: remove dev_err() usage after platform_get_irq()
2019-08-14 10:49:01 -07:00
ad714x-i2c.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 149
2019-05-30 11:25:18 -07:00
ad714x-spi.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 149
2019-05-30 11:25:18 -07:00
ad714x.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 149
2019-05-30 11:25:18 -07:00
ad714x.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 149
2019-05-30 11:25:18 -07:00
adxl34x-i2c.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 149
2019-05-30 11:25:18 -07:00
adxl34x-spi.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 149
2019-05-30 11:25:18 -07:00
adxl34x.c
Input: adxl34x - do not hardcode interrupt trigger type
2023-07-27 08:37:13 +02:00
adxl34x.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 149
2019-05-30 11:25:18 -07:00
apanel.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
arizona-haptics.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
ati_remote2.c
Input: ati_remote2 - add missing newlines when printing module parameters
2020-10-14 10:33:06 +02:00
atlas_btns.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156
2019-05-30 11:26:35 -07:00
atmel_captouch.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282
2019-06-05 17:36:37 +02:00
axp20x-pek.c
Input: remove dev_err() usage after platform_get_irq()
2019-08-14 10:49:01 -07:00
bma150.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61
2019-05-24 17:36:45 +02:00
cm109.c
Input: cm109 - do not stomp on control URB
2020-12-16 10:56:57 +01:00
cma3000_d0x_i2c.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 234
2019-06-19 17:09:07 +02:00
cma3000_d0x.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 234
2019-06-19 17:09:07 +02:00
cma3000_d0x.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 234
2019-06-19 17:09:07 +02:00
cobalt_btns.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 1
2019-05-21 11:28:39 +02:00
cpcap-pwrbutton.c
input: cpcap-pwrbutton: New driver
2017-04-11 15:18:09 +01:00
da9052_onkey.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
da9055_onkey.c
Input: remove dev_err() usage after platform_get_irq()
2019-08-14 10:49:01 -07:00
da9063_onkey.c
Input: da9063 - fix capability and drop KEY_SLEEP
2019-10-02 14:04:41 -07:00
dm355evm_keys.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
drv260x.c
Input: drv260x - sleep between polling GO bit
2023-07-27 08:37:12 +02:00
drv2665.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
drv2667.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174
2019-05-30 11:26:41 -07:00
e3x0-button.c
Input: remove dev_err() usage after platform_get_irq()
2019-08-14 10:49:01 -07:00
gp2ap002a00f.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
gpio_decoder.c
…
gpio-beeper.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
gpio-vibra.c
Input: add a driver for GPIO controllable vibrators
2019-04-30 00:11:25 -07:00
hisi_powerkey.c
Input: remove dev_err() usage after platform_get_irq()
2019-08-14 10:49:01 -07:00
hp_sdc_rtc.c
Input: hp_sdc_rtc - Switch to use %ptR
2018-12-10 22:40:14 +01:00
ideapad_slidebar.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
ims-pcu.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
ixp4xx-beeper.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
Kconfig
Input: soc_button_array - add support for newer surface devices
2019-07-28 12:58:43 +03:00
keyspan_remote.c
Input: keyspan-remote - fix control-message timeouts
2020-01-29 16:45:27 +01:00
kxtj9.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 333
2019-06-05 17:37:06 +02:00
m68kspkr.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
Makefile
- Core Frameworks
2019-05-14 10:39:08 -07:00
max8925_onkey.c
Input: remove dev_err() usage after platform_get_irq()
2019-08-14 10:49:01 -07:00
max8997_haptic.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156
2019-05-30 11:26:35 -07:00
max77650-onkey.c
Input: max77650-onkey - add of_match table
2020-02-05 21:22:49 +00:00
max77693-haptic.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
mc13783-pwrbutton.c
…
mma8450.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61
2019-05-24 17:36:45 +02:00
msm-vibrator.c
Input: msm-vibrator - use correct gpio header
2019-03-09 15:57:15 -08:00
palmas-pwrbutton.c
…
pcap_keys.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
pcf8574_keypad.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 149
2019-05-30 11:25:18 -07:00
pcf50633-input.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
pcspkr.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
pm8xxx-vibrator.c
Input: pm8xxx-vib - fix handling of separate enable register
2020-01-29 16:45:28 +01:00
pm8941-pwrkey.c
Input: remove dev_err() usage after platform_get_irq()
2019-08-14 10:49:01 -07:00
pmic8xxx-pwrkey.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284
2019-06-05 17:36:37 +02:00
powermate.c
Input: powermate - fix use-after-free in powermate_config_complete
2023-10-25 11:53:19 +02:00
pwm-beeper.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 151
2019-05-30 11:26:28 -07:00
pwm-vibra.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
rave-sp-pwrbutton.c
Input: add RAVE SP Powerbutton driver
2018-03-08 15:34:45 -08:00
rb532_button.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
regulator-haptic.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
retu-pwrbutton.c
…
rk805-pwrkey.c
Input: rk805-pwrkey - fix module autoloading
2022-09-15 12:04:51 +02:00
rotary_encoder.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500
2019-06-19 17:09:55 +02:00
sc27xx-vibra.c
Input: add Spreadtrum vibrator driver
2018-06-04 13:36:11 -07:00
sgi_btns.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 1
2019-05-21 11:28:39 +02:00
sirfsoc-onkey.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 4
2019-05-21 11:28:40 +02:00
soc_button_array.c
Input: soc_button_array - partial revert of support for newer surface devices
2019-10-08 16:45:56 -07:00
sparcspkr.c
Input: sparcspkr - fix refcount leak in bbc_beep_probe
2022-06-14 18:11:42 +02:00
stpmic1_onkey.c
Input: remove dev_err() usage after platform_get_irq()
2019-08-14 10:49:01 -07:00
tps65218-pwrbutton.c
Input: remove dev_err() usage after platform_get_irq()
2019-08-14 10:49:01 -07:00
twl4030-pwrbutton.c
mfd: twl: Move header file out of I2C realm
2017-09-04 14:41:02 +01:00
twl4030-vibra.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 336
2019-06-05 17:37:07 +02:00
twl6040-vibra.c
Input: remove dev_err() usage after platform_get_irq()
2019-08-14 10:49:01 -07:00
uinput.c
Input: input_event - fix struct padding on sparc64
2020-01-14 20:08:24 +01:00
wistron_btns.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 414
2019-06-05 17:37:14 +02:00
wm831x-on.c
…
xen-kbdfront.c
Input: xen-kbdfront - mark expected switch fall-through
2018-10-16 17:12:48 -07:00
yealink.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156
2019-05-30 11:26:35 -07:00
yealink.h
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156
2019-05-30 11:26:35 -07:00