diff --git a/patches.suse/HID-bigben-use-spinlock-to-safely-schedule-workers.patch b/patches.suse/HID-bigben-use-spinlock-to-safely-schedule-workers.patch new file mode 100644 index 0000000..efc24c0 --- /dev/null +++ b/patches.suse/HID-bigben-use-spinlock-to-safely-schedule-workers.patch @@ -0,0 +1,83 @@ +From 76ca8da989c7d97a7f76c75d475fe95a584439d7 Mon Sep 17 00:00:00 2001 +From: Pietro Borrello +Date: Sun, 12 Feb 2023 19:00:01 +0000 +Subject: [PATCH] HID: bigben: use spinlock to safely schedule workers +Git-commit: 76ca8da989c7d97a7f76c75d475fe95a584439d7 +Patch-mainline: v6.3-rc1 +References: CVE-2023-25012 bsc#1207560 + +Use spinlocks to deal with workers introducing a wrapper +bigben_schedule_work(), and several spinlock checks. +Otherwise, bigben_set_led() may schedule bigben->worker after the +structure has been freed, causing a use-after-free. + +Fixes: 4eb1b01de5b9 ("HID: hid-bigbenff: fix race condition for scheduled work during removal") +Signed-off-by: Pietro Borrello +Link: https://lore.kernel.org/r/20230125-hid-unregister-leds-v4-3-7860c5763c38@diag.uniroma1.it +Signed-off-by: Benjamin Tissoires +Acked-by: Takashi Iwai + +--- + drivers/hid/hid-bigbenff.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c +index b98c5f31c184..9d6560db762b 100644 +--- a/drivers/hid/hid-bigbenff.c ++++ b/drivers/hid/hid-bigbenff.c +@@ -185,6 +185,15 @@ struct bigben_device { + struct work_struct worker; + }; + ++static inline void bigben_schedule_work(struct bigben_device *bigben) ++{ ++ unsigned long flags; ++ ++ spin_lock_irqsave(&bigben->lock, flags); ++ if (!bigben->removed) ++ schedule_work(&bigben->worker); ++ spin_unlock_irqrestore(&bigben->lock, flags); ++} + + static void bigben_worker(struct work_struct *work) + { +@@ -197,9 +206,6 @@ static void bigben_worker(struct work_struct *work) + u32 len; + unsigned long flags; + +- if (bigben->removed) +- return; +- + buf = hid_alloc_report_buf(bigben->report, GFP_KERNEL); + if (!buf) + return; +@@ -285,7 +291,7 @@ static int hid_bigben_play_effect(struct input_dev *dev, void *data, + bigben->work_ff = true; + spin_unlock_irqrestore(&bigben->lock, flags); + +- schedule_work(&bigben->worker); ++ bigben_schedule_work(bigben); + } + + return 0; +@@ -320,7 +326,7 @@ static void bigben_set_led(struct led_classdev *led, + + if (work) { + bigben->work_led = true; +- schedule_work(&bigben->worker); ++ bigben_schedule_work(bigben); + } + return; + } +@@ -450,7 +456,7 @@ static int bigben_probe(struct hid_device *hid, + bigben->left_motor_force = 0; + bigben->work_led = true; + bigben->work_ff = true; +- schedule_work(&bigben->worker); ++ bigben_schedule_work(bigben); + + hid_info(hid, "LED and force feedback support for BigBen gamepad\n"); + +-- +2.35.3 + diff --git a/series.conf b/series.conf index cce03de..6dd483a 100644 --- a/series.conf +++ b/series.conf @@ -23066,6 +23066,7 @@ patches.suse/net-mpls-fix-stale-pointer-if-allocation-fails-durin.patch patches.suse/HID-bigben-use-spinlock-to-protect-concurrent-access.patch patches.suse/HID-bigben_worker-remove-unneeded-check-on-report_fi.patch + patches.suse/HID-bigben-use-spinlock-to-safely-schedule-workers.patch patches.suse/media-rc-Fix-use-after-free-bugs-caused-by-ene_tx_ir.patch # netdev/net