Re: [PATCH v2] HID: uclogic: fix UAF on inrange_timer at teardown and probe error

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing kfree(drvdata->desc_ptr) in the uclogic_probe error path leads to a memory leak of the dynamically allocated replacement report descriptor.
--

--- Patch [1]: [PATCH v2] HID: uclogic: fix UAF on inrange_timer at teardown and probe error ---
commit 765009419dfdd98b6d556b9c30dc95cac5ee9252
Author: Doruk Tan Ozturk <doruk@0sec.ai>

HID: uclogic: fix UAF on inrange_timer at teardown and probe error

This commit replaces timer_delete_sync() with timer_shutdown_sync() to
prevent use-after-free bugs caused by the timer being re-armed during device
teardown. It also ensures the timer is properly shut down in the probe error
path.

> diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c
> --- a/drivers/hid/hid-uclogic-core.c
> +++ b/drivers/hid/hid-uclogic-core.c
> @@ -267,6 +267,13 @@ static int uclogic_probe(struct hid_device *hdev,
>  	/* Assume "remove" might not be called if "probe" failed */
>  	if (params_initialized)
>  		uclogic_params_cleanup(&drvdata->params);
> +	/*
> +	 * If hid_hw_start() started I/O and then failed, raw_event may have
> +	 * armed the timer; shut it down so it cannot fire on the devm-freed
> +	 * drvdata after probe returns.
> +	 */
> +	if (drvdata)
> +		timer_shutdown_sync(&drvdata->inrange_timer);

[Severity: High]
This isn't a bug introduced by this patch, but does this error path leak
drvdata->desc_ptr?

If uclogic_probe() successfully allocates drvdata->desc_ptr via
uclogic_params_get_desc(), but a subsequent initialization step like
hid_parse() or hid_hw_start() fails, it jumps to the failure label. The
error path cleans up params and shuts down the timer, but it appears to miss
calling kfree(drvdata->desc_ptr) before returning.

>  	return rc;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260711080350.81108-1-doruk@0sec.ai?part=1