From: Chad Aldreda <ca@modelmiser.com>
To: Jiri Kosina <jikos@kernel.org>, Benjamin Tissoires <bentiss@kernel.org>
Cc: Jonathan Cameron <jic23@kernel.org>,
Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>,
linux-input@vger.kernel.org, linux-iio@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: [PATCH 2/2] HID: sensor: custom: Set the owner of the misc file operations
Date: Fri, 06 Nov 2026 12:49:43 +0000 [thread overview]
Message-ID: <20261106124914.2892604-2-ca@modelmiser.com> (raw)
In-Reply-To: <20261106124914.2892604-1-ca@modelmiser.com>
hid_sensor_custom_fops has no .owner, so an open file on the misc node
does not pin the module: with the node open, the module can be
unloaded, and the file's later release() calls into freed module text.
Set .owner to THIS_MODULE so misc_open()'s fops_get() takes a module
reference for each open file.
Found by review of the previous fix. Tested in QEMU with the driver
built as a module and the uhid reproducer holding the node open. Without
this change, rmmod succeeds and the later close() oopses in filp_flush()
on a page fault in the unloaded module. With it, rmmod fails while the
node is open, and succeeds after close() with no oops.
Fixes: 4a7de0519df5 ("HID: sensor: Custom and Generic sensor support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Chad Aldreda <ca@modelmiser.com>
---
drivers/hid/hid-sensor-custom.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/hid/hid-sensor-custom.c b/drivers/hid/hid-sensor-custom.c
index 47800efdaf..bee612eb1d 100644
--- a/drivers/hid/hid-sensor-custom.c
+++ b/drivers/hid/hid-sensor-custom.c
@@ -745,6 +745,7 @@ static __poll_t hid_sensor_custom_poll(struct file *file,
}
static const struct file_operations hid_sensor_custom_fops = {
+ .owner = THIS_MODULE,
.open = hid_sensor_custom_open,
.read = hid_sensor_custom_read,
.release = hid_sensor_custom_release,
--
2.43.0
next prev parent reply other threads:[~2026-11-06 12:49 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-06 12:49 [PATCH 1/2] HID: sensor: custom: Fix use-after-free when the node is open across removal Chad Aldreda
2026-11-06 12:49 ` Chad Aldreda [this message]
2026-11-06 12:56 ` Chad Aldreda
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261106124914.2892604-2-ca@modelmiser.com \
--to=ca@modelmiser.com \
--cc=bentiss@kernel.org \
--cc=jic23@kernel.org \
--cc=jikos@kernel.org \
--cc=linux-iio@vger.kernel.org \
--cc=linux-input@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=srinivas.pandruvada@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.