[v1] HID: logitech-hidpp: cancel reset_hi_res_work on probe failure

[PATCH] HID: logitech-hidpp: cancel reset_hi_res_work on probe failure

Dmitriy Geels posted 1 patch 1 month ago

Diff against v1
Download mbox

There is a newer version of this series

drivers/hid/hid-logitech-hidpp.c | 1 +
1 file changed, 1 insertion(+)

Expand all Fold all

[PATCH] HID: logitech-hidpp: cancel reset_hi_res_work on probe failure

Posted by Dmitriy Geels 1 month ago

The probe error path cancels hidpp->work before freeing the HID++ device
data, but does not cancel reset_hi_res_work.

reset_hi_res_work can be scheduled while probing the device. If probe
subsequently fails, the work can run after the driver data has been
freed.

Cancel reset_hi_res_work in the probe error path to prevent a potential
use-after-free.

Fixes: ed80cc4667ac ("HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL")

Signed-off-by: Dmitriy Geels <dmitriy.geels@gmail.com>
---
This patch is a result of Sashiko AI review for "HID: logitech-hidpp:
add native touchpad support for K400 Plus":
 - [High] Missing cancel_work_sync for reset_hi_res_work in the probe error path leads to a Use-After-Free.

 drivers/hid/hid-logitech-hidpp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 9a6b04283130..279384fa9835 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -4925,6 +4925,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
 hid_hw_start_fail:
 	sysfs_remove_group(&hdev->dev.kobj, &ps_attribute_group);
 	cancel_work_sync(&hidpp->work);
+	cancel_work_sync(&hidpp->reset_hi_res_work);
 	mutex_destroy(&hidpp->send_mutex);
 	return ret;
 }
-- 
2.55.0