Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/drivers/input/misc
History
Javier Carrasco eeef84baec Input: powermate - fix use-after-free in powermate_config_complete 
commit 5c15c60e7be615f05a45cd905093a54b11f461bc upstream.

syzbot has found a use-after-free bug [1] in the powermate driver. This
happens when the device is disconnected, which leads to a memory free from
the powermate_device struct.  When an asynchronous control message
completes after the kfree and its callback is invoked, the lock does not
exist anymore and hence the bug.

Use usb_kill_urb() on pm->config to cancel any in-progress requests upon
device disconnection.

[1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e

Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Reported-by: syzbot+0434ac83f907a1dbdd1e@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20230916-topic-powermate_use_after_free-v3-1-64412b81a7a2@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-11-08 11:25:50 +01:00
..
hall Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
88pm80x_onkey.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
88pm860x_onkey.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ab8500-ponkey.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ad714x-i2c.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ad714x-spi.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ad714x.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ad714x.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
adxl34x-i2c.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
adxl34x-spi.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
adxl34x.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
adxl34x.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
apanel.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
arizona-haptics.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ati_remote2.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
atlas_btns.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
atmel_captouch.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
axp20x-pek.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bma150.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cm109.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cma3000_d0x.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cma3000_d0x.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cma3000_d0x_i2c.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cobalt_btns.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cpcap-pwrbutton.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
da9052_onkey.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
da9055_onkey.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
da9063_onkey.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dm355evm_keys.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drv260x.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drv2665.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drv2667.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
e3x0-button.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
gpio-beeper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
gpio-vibra.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
gpio_decoder.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hisi_powerkey.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hp_sdc_rtc.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ideapad_slidebar.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ims-pcu.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
iqs269a.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ixp4xx-beeper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
keyspan_remote.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kxtj9.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
m68kspkr.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
max8925_onkey.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
max8997_haptic.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
max77650-onkey.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
max77693-haptic.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mc13783-pwrbutton.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mma8450.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
palmas-pwrbutton.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pcap_keys.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pcf8574_keypad.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pcf50633-input.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pcspkr.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pm8xxx-vibrator.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pm8941-pwrkey.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pmic8xxx-pwrkey.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
powermate.c Input: powermate - fix use-after-free in powermate_config_complete 2024-11-08 11:25:50 +01:00
pwm-beeper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pwm-vibra.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
rave-sp-pwrbutton.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
rb532_button.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
regulator-haptic.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
retu-pwrbutton.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
rk805-pwrkey.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
rotary_encoder.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sc27xx-vibra.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sgi_btns.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sirfsoc-onkey.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
soc_button_array.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sparcspkr.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
stpmic1_onkey.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tps65218-pwrbutton.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
twl4030-pwrbutton.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
twl4030-vibra.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
twl6040-vibra.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uinput.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
wistron_btns.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
wm831x-on.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xen-kbdfront.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
yealink.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
yealink.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00