* [PATCH] HID: wacom: Prevent potential null dereference after disconnect
@ 2014-10-07 17:54 Jason Gerecke
2014-10-08 18:25 ` [PATCH v2] " Jason Gerecke
0 siblings, 1 reply; 6+ messages in thread
From: Jason Gerecke @ 2014-10-07 17:54 UTC (permalink / raw)
To: jkosina, benjamin.tissoires, pinglinux
Cc: linux-input, linux-kernel, Jason Gerecke
Repeated connect/disconnect cycles under GNOME can trigger an occasional
OOPS from within e.g. wacom_led_select_store, presumably due to a timing
issue where userspace begins setting a value immediately before the
device disconnects and our shared data is whisked away.
Signed-off-by: Jason Gerecke <killertofu@gmail.com>
---
drivers/hid/wacom_sys.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index 8593047..d9ae467 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -641,6 +641,9 @@ static ssize_t wacom_led_select_store(struct device *dev, int set_id,
unsigned int id;
int err;
+ if (!wacom)
+ return -ENODEV;
+
err = kstrtouint(buf, 10, &id);
if (err)
return err;
@@ -666,6 +669,8 @@ static ssize_t wacom_led##SET_ID##_select_show(struct device *dev, \
{ \
struct hid_device *hdev = container_of(dev, struct hid_device, dev);\
struct wacom *wacom = hid_get_drvdata(hdev); \
+ if (!wacom) \
+ return -ENODEV; \
return scnprintf(buf, PAGE_SIZE, "%d\n", \
wacom->led.select[SET_ID]); \
} \
@@ -702,7 +707,8 @@ static ssize_t wacom_##name##_luminance_store(struct device *dev, \
{ \
struct hid_device *hdev = container_of(dev, struct hid_device, dev);\
struct wacom *wacom = hid_get_drvdata(hdev); \
- \
+ if (!wacom) \
+ return -ENODEV; \
return wacom_luminance_store(wacom, &wacom->led.field, \
buf, count); \
} \
@@ -710,6 +716,8 @@ static ssize_t wacom_##name##_luminance_show(struct device *dev, \
struct device_attribute *attr, char *buf) \
{ \
struct wacom *wacom = dev_get_drvdata(dev); \
+ if (!wacom) \
+ return -ENODEV;
return scnprintf(buf, PAGE_SIZE, "%d\n", wacom->led.field); \
} \
static DEVICE_ATTR(name##_luminance, DEV_ATTR_RW_PERM, \
@@ -729,6 +737,9 @@ static ssize_t wacom_button_image_store(struct device *dev, int button_id,
unsigned len;
u8 xfer_id;
+ if (!wacom)
+ return -ENODEV;
+
if (hdev->bus == BUS_BLUETOOTH) {
len = 256;
xfer_id = WAC_CMD_ICON_BT_XFER;
--
2.1.2
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH v2] HID: wacom: Prevent potential null dereference after disconnect
2014-10-07 17:54 [PATCH] HID: wacom: Prevent potential null dereference after disconnect Jason Gerecke
@ 2014-10-08 18:25 ` Jason Gerecke
2014-10-08 21:40 ` Dmitry Torokhov
0 siblings, 1 reply; 6+ messages in thread
From: Jason Gerecke @ 2014-10-08 18:25 UTC (permalink / raw)
To: jkosina, benjamin.tissoires, pinglinux
Cc: linux-input, linux-kernel, Jason Gerecke
Repeated connect/disconnect cycles under GNOME can trigger an occasional
OOPS from within e.g. wacom_led_select_store, presumably due to a timing
issue where userspace begins setting a value immediately before the
device disconnects and our shared data is whisked away.
Signed-off-by: Jason Gerecke <killertofu@gmail.com>
---
Changes in v2:
* Added in missing escape character
drivers/hid/wacom_sys.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index 8593047..265429b 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -641,6 +641,9 @@ static ssize_t wacom_led_select_store(struct device *dev, int set_id,
unsigned int id;
int err;
+ if (!wacom)
+ return -ENODEV;
+
err = kstrtouint(buf, 10, &id);
if (err)
return err;
@@ -666,6 +669,8 @@ static ssize_t wacom_led##SET_ID##_select_show(struct device *dev, \
{ \
struct hid_device *hdev = container_of(dev, struct hid_device, dev);\
struct wacom *wacom = hid_get_drvdata(hdev); \
+ if (!wacom) \
+ return -ENODEV; \
return scnprintf(buf, PAGE_SIZE, "%d\n", \
wacom->led.select[SET_ID]); \
} \
@@ -702,7 +707,8 @@ static ssize_t wacom_##name##_luminance_store(struct device *dev, \
{ \
struct hid_device *hdev = container_of(dev, struct hid_device, dev);\
struct wacom *wacom = hid_get_drvdata(hdev); \
- \
+ if (!wacom) \
+ return -ENODEV; \
return wacom_luminance_store(wacom, &wacom->led.field, \
buf, count); \
} \
@@ -710,6 +716,8 @@ static ssize_t wacom_##name##_luminance_show(struct device *dev, \
struct device_attribute *attr, char *buf) \
{ \
struct wacom *wacom = dev_get_drvdata(dev); \
+ if (!wacom) \
+ return -ENODEV; \
return scnprintf(buf, PAGE_SIZE, "%d\n", wacom->led.field); \
} \
static DEVICE_ATTR(name##_luminance, DEV_ATTR_RW_PERM, \
@@ -729,6 +737,9 @@ static ssize_t wacom_button_image_store(struct device *dev, int button_id,
unsigned len;
u8 xfer_id;
+ if (!wacom)
+ return -ENODEV;
+
if (hdev->bus == BUS_BLUETOOTH) {
len = 256;
xfer_id = WAC_CMD_ICON_BT_XFER;
--
2.1.2
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH v2] HID: wacom: Prevent potential null dereference after disconnect
2014-10-08 18:25 ` [PATCH v2] " Jason Gerecke
@ 2014-10-08 21:40 ` Dmitry Torokhov
2014-10-09 0:24 ` Jason Gerecke
0 siblings, 1 reply; 6+ messages in thread
From: Dmitry Torokhov @ 2014-10-08 21:40 UTC (permalink / raw)
To: Jason Gerecke
Cc: jkosina, benjamin.tissoires, pinglinux, linux-input, linux-kernel
On Wed, Oct 08, 2014 at 11:25:42AM -0700, Jason Gerecke wrote:
> Repeated connect/disconnect cycles under GNOME can trigger an occasional
> OOPS from within e.g. wacom_led_select_store, presumably due to a timing
> issue where userspace begins setting a value immediately before the
> device disconnects and our shared data is whisked away.
>
> Signed-off-by: Jason Gerecke <killertofu@gmail.com>
> ---
> Changes in v2:
> * Added in missing escape character
>
> drivers/hid/wacom_sys.c | 13 ++++++++++++-
> 1 file changed, 12 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
> index 8593047..265429b 100644
> --- a/drivers/hid/wacom_sys.c
> +++ b/drivers/hid/wacom_sys.c
> @@ -641,6 +641,9 @@ static ssize_t wacom_led_select_store(struct device *dev, int set_id,
> unsigned int id;
> int err;
>
> + if (!wacom)
> + return -ENODEV;
> +
Strong NAK. If device could disappear before this check it could as well
disappear after your check.
This patch does not solve anything.
> err = kstrtouint(buf, 10, &id);
> if (err)
> return err;
Thanks.
--
Dmitry
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] HID: wacom: Prevent potential null dereference after disconnect
2014-10-08 21:40 ` Dmitry Torokhov
@ 2014-10-09 0:24 ` Jason Gerecke
2014-10-09 0:28 ` Dmitry Torokhov
0 siblings, 1 reply; 6+ messages in thread
From: Jason Gerecke @ 2014-10-09 0:24 UTC (permalink / raw)
To: Dmitry Torokhov
Cc: Jiri Kosina, Benjamin Tissoires, Ping Cheng, Linux Input,
linux-kernel
On Wed, Oct 8, 2014 at 2:40 PM, Dmitry Torokhov
<dmitry.torokhov@gmail.com> wrote:
> On Wed, Oct 08, 2014 at 11:25:42AM -0700, Jason Gerecke wrote:
>> Repeated connect/disconnect cycles under GNOME can trigger an occasional
>> OOPS from within e.g. wacom_led_select_store, presumably due to a timing
>> issue where userspace begins setting a value immediately before the
>> device disconnects and our shared data is whisked away.
>>
>> Signed-off-by: Jason Gerecke <killertofu@gmail.com>
>> ---
>> Changes in v2:
>> * Added in missing escape character
>>
>> drivers/hid/wacom_sys.c | 13 ++++++++++++-
>> 1 file changed, 12 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
>> index 8593047..265429b 100644
>> --- a/drivers/hid/wacom_sys.c
>> +++ b/drivers/hid/wacom_sys.c
>> @@ -641,6 +641,9 @@ static ssize_t wacom_led_select_store(struct device *dev, int set_id,
>> unsigned int id;
>> int err;
>>
>> + if (!wacom)
>> + return -ENODEV;
>> +
>
> Strong NAK. If device could disappear before this check it could as well
> disappear after your check.
>
> This patch does not solve anything.
>
I assume I'll want to either disable interrupts or take a lock
depending on if `wacom_remove` is called from within the interrupt
context, but I haven't had to deal with concurrency in the kernel
before so I'm not entirely sure which option (or which primitive if
locking) would be appropriate...
Jason
---
Now instead of four in the eights place /
you’ve got three, ‘Cause you added one /
(That is to say, eight) to the two, /
But you can’t take seven from three, /
So you look at the sixty-fours....
>> err = kstrtouint(buf, 10, &id);
>> if (err)
>> return err;
>
> Thanks.
>
> --
> Dmitry
> --
> To unsubscribe from this list: send the line "unsubscribe linux-input" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-input" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] HID: wacom: Prevent potential null dereference after disconnect
2014-10-09 0:24 ` Jason Gerecke
@ 2014-10-09 0:28 ` Dmitry Torokhov
2014-10-09 2:08 ` Jason Gerecke
0 siblings, 1 reply; 6+ messages in thread
From: Dmitry Torokhov @ 2014-10-09 0:28 UTC (permalink / raw)
To: Jason Gerecke
Cc: Jiri Kosina, Benjamin Tissoires, Ping Cheng, Linux Input,
linux-kernel
On Wed, Oct 08, 2014 at 05:24:32PM -0700, Jason Gerecke wrote:
> On Wed, Oct 8, 2014 at 2:40 PM, Dmitry Torokhov
> <dmitry.torokhov@gmail.com> wrote:
> > On Wed, Oct 08, 2014 at 11:25:42AM -0700, Jason Gerecke wrote:
> >> Repeated connect/disconnect cycles under GNOME can trigger an occasional
> >> OOPS from within e.g. wacom_led_select_store, presumably due to a timing
> >> issue where userspace begins setting a value immediately before the
> >> device disconnects and our shared data is whisked away.
> >>
> >> Signed-off-by: Jason Gerecke <killertofu@gmail.com>
> >> ---
> >> Changes in v2:
> >> * Added in missing escape character
> >>
> >> drivers/hid/wacom_sys.c | 13 ++++++++++++-
> >> 1 file changed, 12 insertions(+), 1 deletion(-)
> >>
> >> diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
> >> index 8593047..265429b 100644
> >> --- a/drivers/hid/wacom_sys.c
> >> +++ b/drivers/hid/wacom_sys.c
> >> @@ -641,6 +641,9 @@ static ssize_t wacom_led_select_store(struct device *dev, int set_id,
> >> unsigned int id;
> >> int err;
> >>
> >> + if (!wacom)
> >> + return -ENODEV;
> >> +
> >
> > Strong NAK. If device could disappear before this check it could as well
> > disappear after your check.
> >
> > This patch does not solve anything.
> >
>
> I assume I'll want to either disable interrupts or take a lock
> depending on if `wacom_remove` is called from within the interrupt
> context, but I haven't had to deal with concurrency in the kernel
> before so I'm not entirely sure which option (or which primitive if
> locking) would be appropriate...
Actually the sysfs core should not allow anyone descend into sysfs
show/store methods once you return from sysfs_remove*(). So you need to
make sure that pointer is valid until then.
Thanks.
--
Dmitry
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] HID: wacom: Prevent potential null dereference after disconnect
2014-10-09 0:28 ` Dmitry Torokhov
@ 2014-10-09 2:08 ` Jason Gerecke
0 siblings, 0 replies; 6+ messages in thread
From: Jason Gerecke @ 2014-10-09 2:08 UTC (permalink / raw)
To: Dmitry Torokhov
Cc: Jiri Kosina, Benjamin Tissoires, Ping Cheng, Linux Input,
linux-kernel
On Wed, Oct 8, 2014 at 5:28 PM, Dmitry Torokhov
<dmitry.torokhov@gmail.com> wrote:
> On Wed, Oct 08, 2014 at 05:24:32PM -0700, Jason Gerecke wrote:
>> On Wed, Oct 8, 2014 at 2:40 PM, Dmitry Torokhov
>> <dmitry.torokhov@gmail.com> wrote:
>> > On Wed, Oct 08, 2014 at 11:25:42AM -0700, Jason Gerecke wrote:
>> >> Repeated connect/disconnect cycles under GNOME can trigger an occasional
>> >> OOPS from within e.g. wacom_led_select_store, presumably due to a timing
>> >> issue where userspace begins setting a value immediately before the
>> >> device disconnects and our shared data is whisked away.
>> >>
>> >> Signed-off-by: Jason Gerecke <killertofu@gmail.com>
>> >> ---
>> >> Changes in v2:
>> >> * Added in missing escape character
>> >>
>> >> drivers/hid/wacom_sys.c | 13 ++++++++++++-
>> >> 1 file changed, 12 insertions(+), 1 deletion(-)
>> >>
>> >> diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
>> >> index 8593047..265429b 100644
>> >> --- a/drivers/hid/wacom_sys.c
>> >> +++ b/drivers/hid/wacom_sys.c
>> >> @@ -641,6 +641,9 @@ static ssize_t wacom_led_select_store(struct device *dev, int set_id,
>> >> unsigned int id;
>> >> int err;
>> >>
>> >> + if (!wacom)
>> >> + return -ENODEV;
>> >> +
>> >
>> > Strong NAK. If device could disappear before this check it could as well
>> > disappear after your check.
>> >
>> > This patch does not solve anything.
>> >
>>
>> I assume I'll want to either disable interrupts or take a lock
>> depending on if `wacom_remove` is called from within the interrupt
>> context, but I haven't had to deal with concurrency in the kernel
>> before so I'm not entirely sure which option (or which primitive if
>> locking) would be appropriate...
>
> Actually the sysfs core should not allow anyone descend into sysfs
> show/store methods once you return from sysfs_remove*(). So you need to
> make sure that pointer is valid until then.
>
> Thanks.
>
> --
> Dmitry
Hmm. That's odd. The `wacom_remove` function calls
`wacom_destroy_leds` (which is responsible for removing those sysfs
nodes) prior to calling `wacom_remove_shared_data` (which is
responsible for freeing that pointer). I could imagine that a
disconnect which occurred after the sysfs checks were satisfied but
before our function was called would be able to get around that, but I
don't know if the kernel can be interrupted while the sysfs write is
being handled. I'll double-check what the actual state of things is
when the OOPS happens...
Jason
---
Now instead of four in the eights place /
you’ve got three, ‘Cause you added one /
(That is to say, eight) to the two, /
But you can’t take seven from three, /
So you look at the sixty-fours....
--
To unsubscribe from this list: send the line "unsubscribe linux-input" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2014-10-09 2:08 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-10-07 17:54 [PATCH] HID: wacom: Prevent potential null dereference after disconnect Jason Gerecke
2014-10-08 18:25 ` [PATCH v2] " Jason Gerecke
2014-10-08 21:40 ` Dmitry Torokhov
2014-10-09 0:24 ` Jason Gerecke
2014-10-09 0:28 ` Dmitry Torokhov
2014-10-09 2:08 ` Jason Gerecke
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).