TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
ef8cdee81ef52aebb5fc80b67a80f0215be784af
twx-linux/drivers/input/misc
T
History
Javier Carrasco 2efe67c581 Input: powermate - fix use-after-free in powermate_config_complete 
commit 5c15c60e7b upstream.

syzbot has found a use-after-free bug [1] in the powermate driver. This
happens when the device is disconnected, which leads to a memory free from
the powermate_device struct.  When an asynchronous control message
completes after the kfree and its callback is invoked, the lock does not
exist anymore and hence the bug.

Use usb_kill_urb() on pm->config to cancel any in-progress requests upon
device disconnection.

[1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e

Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Reported-by: syzbot+0434ac83f907a1dbdd1e@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20230916-topic-powermate_use_after_free-v3-1-64412b81a7a2@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-10-19 23:08:57 +02:00
..
88pm80x_onkey.c
…
88pm860x_onkey.c
…
ab8500-ponkey.c
Input: ab8500-ponkey - fix incorrect name in 'ab8500_ponkey' doc header
2020-11-08 22:27:54 -08:00
ad714x-i2c.c
…
ad714x-spi.c
…
ad714x.c
…
ad714x.h
…
adxl34x-i2c.c
i2c: Make remove callback return void
2022-08-16 12:46:26 +02:00
adxl34x-spi.c
spi: make remove callback a void function
2022-02-09 13:00:45 +00:00
adxl34x.c
Input: adxl34x - do not hardcode interrupt trigger type
2023-07-19 16:21:17 +02:00
adxl34x.h
Input: adxl34x - make adxl34x_remove() return void
2021-10-12 19:48:52 -07:00
apanel.c
…
ariel-pwrbutton.c
Input: ariel-pwrbutton - add SPI device ID table
2021-10-01 21:24:14 -07:00
arizona-haptics.c
…
atc260x-onkey.c
input: atc260x: Add onkey driver for ATC260x PMICs
2021-03-10 11:10:30 +00:00
ati_remote2.c
Input: remove third argument of usb_maxpacket()
2022-04-23 10:33:53 +02:00
atlas_btns.c
…
atmel_captouch.c
…
axp20x-pek.c
Merge tag 'v5.16' into next
2022-01-17 18:03:39 -08:00
bma150.c
i2c: Make remove callback return void
2022-08-16 12:46:26 +02:00
cm109.c
Input: remove third argument of usb_maxpacket()
2022-04-23 10:33:53 +02:00
cma3000_d0x_i2c.c
i2c: Make remove callback return void
2022-08-16 12:46:26 +02:00
cma3000_d0x.c
…
cma3000_d0x.h
…
cobalt_btns.c
…
cpcap-pwrbutton.c
Input: cpcap-pwrbutton - do not set input parent explicitly
2021-10-16 18:51:02 -07:00
da7280.c
Input: da7280 - protect OF match table with CONFIG_OF
2020-12-18 10:04:34 -08:00
da9052_onkey.c
…
da9055_onkey.c
…
da9063_onkey.c
Input: da9063 - use devm_delayed_work_autocancel()
2022-02-28 23:31:24 -08:00
dm355evm_keys.c
…
drv260x.c
Input: drv260x - sleep between polling GO bit
2023-07-19 16:21:14 +02:00
drv2665.c
Input: use input_device_enabled()
2020-12-02 22:10:33 -08:00
drv2667.c
Input: use input_device_enabled()
2020-12-02 22:10:33 -08:00
e3x0-button.c
…
gpio_decoder.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_30.RULE (part 2)
2022-06-10 14:51:35 +02:00
gpio-beeper.c
…
gpio-vibra.c
…
hisi_powerkey.c
…
hp_sdc_rtc.c
…
ibm-panel.c
Input: ibm-panel - add missing MODULE_DEVICE_TABLE
2022-09-28 09:04:32 -07:00
ideapad_slidebar.c
…
ims-pcu.c
Input: ims-pcu - fix spelling mistake "BOOLTLOADER" -> "BOOTLOADER"
2022-09-28 15:22:46 -07:00
iqs269a.c
Input: Use fallthrough pseudo-keyword
2020-07-07 11:25:54 -07:00
iqs626a.c
Input: iqs626a - prohibit inlining of channel parsing functions
2021-11-28 23:59:35 -08:00
iqs7222.c
Input: iqs7222 - configure power mode before triggering ATI
2023-09-19 12:27:59 +02:00
Kconfig
Input: wistron_btns - disable on UML
2022-12-31 13:32:19 +01:00
keyspan_remote.c
Input: move from strlcpy with unused retval to strscpy
2022-08-18 15:44:08 -07:00
kxtj9.c
Input: use input_device_enabled()
2020-12-02 22:10:33 -08:00
m68kspkr.c
…
Makefile
Input: rt5120 - add power key support
2022-08-31 15:48:49 -07:00
max8925_onkey.c
Input: max8925_onkey - don't mark comment as kernel-doc
2021-10-15 22:10:33 -07:00
max8997_haptic.c
Input: max8997 - simplify open coding of a division using up to 64 divisions
2021-03-25 11:14:08 -07:00
max77650-onkey.c
…
max77693-haptic.c
Input: max77693-haptic - drop unneeded MODULE_ALIAS
2021-10-16 21:18:30 -07:00
mc13783-pwrbutton.c
Input: mc13783-pwrbutton - file headers are not good candidates for kernel-doc
2020-11-19 19:18:22 -08:00
mma8450.c
…
palmas-pwrbutton.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_320.RULE
2022-06-10 14:51:36 +02:00
pcap_keys.c
…
pcf8574_keypad.c
i2c: Make remove callback return void
2022-08-16 12:46:26 +02:00
pcf50633-input.c
…
pcspkr.c
Input: pcspkr - fix fall-through warnings for Clang
2020-11-22 22:16:21 -08:00
pm8xxx-vibrator.c
Input: pm8xxx-vib - fix handling of separate enable register
2020-01-20 20:40:04 -08:00
pm8941-pwrkey.c
Input: pm8941-powerkey - fix debounce on gen2+ PMICs
2023-07-19 16:21:26 +02:00
pmic8xxx-pwrkey.c
…
powermate.c
Input: powermate - fix use-after-free in powermate_config_complete
2023-10-19 23:08:57 +02:00
pwm-beeper.c
…
pwm-vibra.c
Input: Use fallthrough pseudo-keyword
2020-07-07 11:25:54 -07:00
rave-sp-pwrbutton.c
…
rb532_button.c
…
regulator-haptic.c
…
retu-pwrbutton.c
…
rk805-pwrkey.c
Input: rk805-pwrkey - fix module autoloading
2022-08-22 16:59:49 -07:00
rotary_encoder.c
…
rt5120-pwrkey.c
Input: rt5120 - add power key support
2022-08-31 15:48:49 -07:00
sc27xx-vibra.c
Input: sc27xx - add support for sc2730 and sc2721
2020-12-11 19:00:21 -08:00
sgi_btns.c
…
soc_button_array.c
Input: soc_button_array - add invalid acpi_index DMI quirk handling
2023-06-28 11:12:37 +02:00
sparcspkr.c
Input: sparcspkr - fix refcount leak in bbc_beep_probe
2022-05-16 21:10:11 -07:00
stpmic1_onkey.c
…
tps65218-pwrbutton.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_320.RULE
2022-06-10 14:51:36 +02:00
twl4030-pwrbutton.c
Input: twl4030-pwrbutton - add missing of.h include
2022-09-27 08:43:04 -07:00
twl4030-vibra.c
Input: twl4030-vibra - drop legacy, non DT boot support
2022-09-24 22:40:04 -07:00
twl6040-vibra.c
…
uinput.c
…
wistron_btns.c
…
wm831x-on.c
Input: wm831x-on - source file headers are not good candidates for kernel-doc
2020-11-19 19:18:43 -08:00
xen-kbdfront.c
xen: switch gnttab_end_foreign_access() to take a struct page pointer
2022-05-27 11:05:29 +02:00
yealink.c
Input: remove third argument of usb_maxpacket()
2022-04-23 10:33:53 +02:00
yealink.h
…