From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793831504; b=UWqVWgSRwkV7fT3mXwPzcODHnegtcMom4dAfoZ/e54nRIOD4WkDzf8As3WMVya8FyU43 gXuI1kfpdtYREBuVM/iXjtEIsbVr9ICDcmzAwMQZjPBAt2ZfoN4YeWEiBrwIQ+JJKyXiO 1/Gv8zHEpu+EmWOKpvpSNEP3Q/NdT70I/l3xA9LUMMm6KoETzovlc16sm/oZh/SoBmwE6 XyluTWlmRCxAUqojXRszUg0ksKOo3mBs2Mc/2DLgDtb9C71bH/r+7ZfdpWLFK/iHR2k3D QoMaPAMaV7lzcz4VfO6XS07xr6DIvXD0mXloy/uh8++iDEHbzxGpZ+E285/UhMM9fIQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793831504; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=SPWEaGgTigCTMMOZ11qJhTwefPJX5Ey28DrIuWPKxC4=; b=nZFlwoL2VmMxYHx6Vp/zXy3QdDCSkY1TiOlAVuDFPPNBKbYGngs1KDaaDon6GZdyu1E3 s14+rgajNkExsC0CTChD6cxJEKQNaGLogQifc7Do81xKK8GljsfR7i0Ylp37mNguMy+y6 aA3NGLSTbt2Fqk4Cr/7KPZ1SogmbutkghaAhZaY/BCclTQmPiE2HEE0rL6kx3sOS7tuPW PUb7fQxpAhDC5y27ZAdP9Zm+OPVWX7PQnZ4XHbJY1Ya+O+JLr5s8tvnCbGAFejtECyh0G Exh9u2fmZXSZJwo2pn61UEwuCgwcdskOc9phkNcrjiEbQk7V9/Da2bGsQf5YiAWSbmA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=h1vFBj+u; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DD828606B3B8; Wed, 4 Nov 2026 22:31:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=h1vFBj+u Received: by smtp.kernel.org (Postfix) with ESMTPSA id 78E111F00A02; Wed, 4 Nov 2026 22:31:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793831503; bh=SPWEaGgTigCTMMOZ11qJhTwefPJX5Ey28DrIuWPKxC4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=h1vFBj+uGqXHSEo/Gx65mQ9bt2Ehq3yFp6p6iIYVz9wwq2kb26815vyhWglJZwF3y eb/K5On1sp5zL+hvRA3uI051zGeSs/D38WB/2k8Ga9XPH6fcOGgJJfRM+/Pjhqe5ys 8P7Gh7VW+IEtxFZ/N3Hkfa4Yp+OPfcq1/kQzxQzY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, syzbot+563191a4939ddbfe73d4@syzkaller.appspotmail.com, Yousef Alhouseen , Jiri Kosina Subject: [PATCH 6.18 0716/1005] HID: hiddev: keep state alive through disconnect unlock Date: Wed, 4 Nov 2026 16:07:29 -0500 Message-ID: <20261104211103.593984061@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261104211043.516122098@linuxfoundation.org> References: <20261104211043.516122098@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Yousef Alhouseen commit 03f449b5de36a25fc5eba7dabf2b4494389bdb91 upstream. mutex_unlock() clears the mutex owner before taking its wait lock. A thread spinning in the final hiddev file release can acquire existancelock after hiddev_disconnect() clears the owner, then free hiddev before the disconnecting thread reaches the mutex wait lock. This causes a use-after-free in the mutex slow unlock path. Give the connection and each open file an explicit reference. Drop each reference only after its existancelock critical section has completed, so neither unlock path can free the mutex while the other is still using it. Fixes: 079034073faf ("HID: hiddev cleanup -- handle all error conditions properly") Reported-by: syzbot+563191a4939ddbfe73d4@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=563191a4939ddbfe73d4 Cc: stable@vger.kernel.org Signed-off-by: Yousef Alhouseen Link: https://syzkaller.appspot.com/bug?extid=563191a4939ddbfe73d4 Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman --- drivers/hid/usbhid/hiddev.c | 37 +++++++++++++++++++------------------ include/linux/hiddev.h | 2 ++ 2 files changed, 21 insertions(+), 18 deletions(-) --- a/drivers/hid/usbhid/hiddev.c +++ b/drivers/hid/usbhid/hiddev.c @@ -46,6 +46,12 @@ struct hiddev_list { struct mutex thread_lock; }; +static void hiddev_put(struct hiddev *hiddev) +{ + if (refcount_dec_and_test(&hiddev->refcount)) + kfree(hiddev); +} + /* * Find a report, given the report's type and ID. The ID can be specified * indirectly by REPORT_ID_FIRST (which returns the first report of the given @@ -216,26 +222,21 @@ static int hiddev_fasync(int fd, struct static int hiddev_release(struct inode * inode, struct file * file) { struct hiddev_list *list = file->private_data; + struct hiddev *hiddev = list->hiddev; unsigned long flags; - spin_lock_irqsave(&list->hiddev->list_lock, flags); + spin_lock_irqsave(&hiddev->list_lock, flags); list_del(&list->node); - spin_unlock_irqrestore(&list->hiddev->list_lock, flags); + spin_unlock_irqrestore(&hiddev->list_lock, flags); - mutex_lock(&list->hiddev->existancelock); - if (!--list->hiddev->open) { - if (list->hiddev->exist) { - hid_hw_close(list->hiddev->hid); - hid_hw_power(list->hiddev->hid, PM_HINT_NORMAL); - } else { - mutex_unlock(&list->hiddev->existancelock); - kfree(list->hiddev); - vfree(list); - return 0; - } + mutex_lock(&hiddev->existancelock); + if (!--hiddev->open && hiddev->exist) { + hid_hw_close(hiddev->hid); + hid_hw_power(hiddev->hid, PM_HINT_NORMAL); } - mutex_unlock(&list->hiddev->existancelock); + mutex_unlock(&hiddev->existancelock); + hiddev_put(hiddev); vfree(list); return 0; @@ -270,6 +271,7 @@ static int __hiddev_open(struct hiddev * spin_unlock_irq(&hiddev->list_lock); file->private_data = list; + refcount_inc(&hiddev->refcount); return 0; @@ -897,6 +899,7 @@ int hiddev_connect(struct hid_device *hi INIT_LIST_HEAD(&hiddev->list); spin_lock_init(&hiddev->list_lock); mutex_init(&hiddev->existancelock); + refcount_set(&hiddev->refcount, 1); hid->hiddev = hiddev; hiddev->hid = hid; hiddev->exist = 1; @@ -937,9 +940,7 @@ void hiddev_disconnect(struct hid_device if (hiddev->open) { hid_hw_close(hiddev->hid); wake_up_interruptible(&hiddev->wait); - mutex_unlock(&hiddev->existancelock); - } else { - mutex_unlock(&hiddev->existancelock); - kfree(hiddev); } + mutex_unlock(&hiddev->existancelock); + hiddev_put(hiddev); } --- a/include/linux/hiddev.h +++ b/include/linux/hiddev.h @@ -13,6 +13,7 @@ #ifndef _HIDDEV_H #define _HIDDEV_H +#include #include @@ -24,6 +25,7 @@ struct hiddev { int minor; int exist; int open; + refcount_t refcount; struct mutex existancelock; wait_queue_head_t wait; struct hid_device *hid;