Re: [PATCH v8 09/12] HID: asus: add support to force feedback

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] hid: asus: UAF in usbhid_output_report due to race in ally_x_setup_input error path
--

commit 8ccfbfaa682d3590de29005dd9112219250dde2e
Author: Denis Benato <denis.benato@linux.dev>

    HID: asus: add support to force feedback

This commit adds force feedback support to the ROG Ally X gamepad interface.
It implements a work-queue based approach for sending FF_RUMBLE packets as
output reports to avoid sleeping calls in atomic context.

> diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c
> index bb664bd9e140b..a8ecc95f2db1f 100644
> --- a/drivers/hid/hid-asus.c
> +++ b/drivers/hid/hid-asus.c

[ ... ]

> @@ -2845,6 +2845,11 @@ static int ally_x_setup_input(struct hid_device *hdev, struct ally_handheld *all
>  
>  	return 0;
>  ally_x_setup_input_err:
> +	spin_lock_irqsave(&ally_data_lock, flags);
> +	if (ally->ally_x_hdev == hdev)
> +		ally->ally_x_hdev = NULL;
> +	spin_unlock_irqrestore(&ally_data_lock, flags);
> +

[Severity: High]
Does unpublishing ally_x_hdev here without acquiring intf_mutex break
serialization with hid_asus_ally_init()?

If the CFG interface probes concurrently with the Gamepad interface, and the
Gamepad probe fails at input_register_device(), this error path unpublishes
ally_x_hdev without holding intf_mutex.

Could hid_asus_ally_init() concurrently snapshot the gamepad hdev before it
is unpublished, and subsequently call ally_x_send_ff_off()?

Meanwhile, the Gamepad probe returns an error, prompting the HID core to call
hid_hw_stop() on the gamepad interface. hid_hw_stop() calls usbhid_stop(),
which frees the urbout pointer.

Could ally_x_send_ff_off() then call hid_hw_output_report() on the stopped
transport, racing with the free of the urbout pointer and causing a
use-after-free?

>  	input_free_device(input);
>  	return ret;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922230205.6847-1-denis.benato@linux.dev?part=9