From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
To: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Cc: jikos@kernel.org, bentiss@kernel.org,
linux-input@vger.kernel.org, linux-kernel@vger.kernel.org,
stable@vger.kernel.org
Subject: Re: [PATCH v7 1/2] HID: haptic: reorder try_module_get/get_device before input_ff_create
Date: Fri, 16 Oct 2026 11:16:48 -0700 [thread overview]
Message-ID: <atJSOv7fRdtyeoH7@google.com> (raw)
In-Reply-To: <20261016163349.3293666-2-qwe.aldo@gmail.com>
Hi Aldo,
On Fri, Oct 16, 2026 at 01:33:48PM -0300, Aldo Ariel Panzardo wrote:
> Move try_module_get() and get_device() before input_ff_create() in
> hid_haptic_init(). The original order placed them after
> input_ff_create(), and failures went to input_free which called
> input_ff_destroy() without ever setting ret. The caller saw ret == 0
> on failure and kept a dangling pointer to the haptic struct.
How about we simply stop pretending that these can fail? I.e. replace
try_module_get() with __module_get()
As far as get_device() it cannot fail and is redundant:
- get_device(&hdev->dev) only returns NULL if its argument is NULL,
which is impossible here since hdev was already dereferenced
throughout hid_haptic_init()
- In hidinput_allocate(), input_dev->dev.parent is set to &hdev->dev.
The driver core will already hold a reference to &hdev->dev
(dev->parent) that will only released in device_release() after
input_dev_release() -> input_ff_destroy() -> hid_haptic_destroy()
finishes.
Additionally I think we should simply fail probe if hid_haptic_init()
fails instead of trying to limp along without it.
Thanks.
--
Dmitry
next prev parent reply other threads:[~2026-10-16 18:16 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20261009103333.2476105-1-qwe.aldo@gmail.com>
2026-10-16 13:55 ` [PATCH v5 0/2] HID: multitouch: fix use-after-free of haptic data on delayed input release Aldo Ariel Panzardo
2026-10-16 13:55 ` [PATCH v5 1/2] HID: haptic: reorder try_module_get/get_device before input_ff_create Aldo Ariel Panzardo
2026-10-16 14:06 ` sashiko-bot
2026-10-16 13:55 ` [PATCH v5 2/2] HID: multitouch: fix use-after-free of haptic data on delayed input release Aldo Ariel Panzardo
2026-10-16 14:12 ` sashiko-bot
2026-10-16 15:13 ` [PATCH v6 0/2] " Aldo Ariel Panzardo
2026-10-16 15:13 ` [PATCH v6 1/2] HID: haptic: reorder try_module_get/get_device before input_ff_create Aldo Ariel Panzardo
2026-10-16 15:35 ` sashiko-bot
2026-10-16 15:13 ` [PATCH v6 2/2] HID: multitouch: fix use-after-free of haptic data on delayed input release Aldo Ariel Panzardo
2026-10-16 16:33 ` [PATCH v7 0/2] " Aldo Ariel Panzardo
2026-10-16 16:33 ` [PATCH v7 1/2] HID: haptic: reorder try_module_get/get_device before input_ff_create Aldo Ariel Panzardo
2026-10-16 16:42 ` sashiko-bot
2026-10-16 18:16 ` Dmitry Torokhov [this message]
2026-10-16 16:33 ` [PATCH v7 2/2] HID: multitouch: fix use-after-free of haptic data on delayed input release Aldo Ariel Panzardo
2026-10-16 17:30 ` [PATCH v8 0/2] " Aldo Ariel Panzardo
2026-10-16 17:30 ` [PATCH v8 1/2] HID: haptic: reorder try_module_get/get_device before input_ff_create Aldo Ariel Panzardo
2026-10-16 17:30 ` [PATCH v8 2/2] HID: multitouch: fix use-after-free of haptic data on delayed input release Aldo Ariel Panzardo
2026-10-16 18:27 ` Dmitry Torokhov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=atJSOv7fRdtyeoH7@google.com \
--to=dmitry.torokhov@gmail.com \
--cc=bentiss@kernel.org \
--cc=jikos@kernel.org \
--cc=linux-input@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=qwe.aldo@gmail.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.