[PATCH v2] HID: core: fix device cleanup on allocation failure

[Tristan Madani <tristmd@gmail.com>]

From: Tristan Madani <tristan@talencesecurity.com>

hid_allocate_device() calls hid_destroy_device() in its error path when
hid_bpf_device_init() fails.  hid_destroy_device() invokes
hid_bpf_destroy_device(), which calls synchronize_srcu() and
cleanup_srcu_struct() on the SRCU structure.  However,
hid_bpf_device_init() returns the result of init_srcu_struct(), so
when it fails, init_srcu_struct() was called but did not succeed and
its failure path rolled the SRCU internal pointers back to NULL.
Dereferencing them causes a general protection fault.

Use put_device() directly in the error path to release the device
without invoking SRCU cleanup on the failed state.

Fixes: 6cd735f0e57a ("HID: bpf: protect HID-BPF prog_list access by a SRCU")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---

Changes since v1:
  - Updated commit message to clarify that init_srcu_struct() was called
    but failed (rolled pointers back to NULL), not that it was never called.
  - Updated code comment to match.
  Per bpf-ci bot review feedback.
 drivers/hid/hid-core.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index a3ff0514f9cdf..7d1b781c6debf 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -3115,7 +3115,11 @@ struct hid_device *hid_allocate_device(void)
 	return hdev;
 
 out_err:
-	hid_destroy_device(hdev);
+	/* init_srcu_struct() was called but failed; the SRCU struct
+	 * is not usable.  Skip hid_destroy_device() which would call
+	 * cleanup_srcu_struct() on the failed state.
+	 */
+	put_device(&hdev->dev);
 	return ERR_PTR(ret);
 }
 EXPORT_SYMBOL_GPL(hid_allocate_device);
-- 
2.47.3