From: Rafael Passos <rafael@rcpassos.me>
To: rafael@rcpassos.me
Cc: bentiss@kernel.org, david@readahead.eu, jikos@kernel.org,
jkoolstra@xs4all.nl, linux-input@vger.kernel.org
Subject: [TEST] Patch used for testing the wiimote_probe_cleanup
Date: Wed, 15 Jul 2026 18:35:13 -0300 [thread overview]
Message-ID: <20260715213513.3929001-1-rafael@rcpassos.me> (raw)
In-Reply-To: <20260715212501.3920033-4-rafael@rcpassos.me>
[DO NOT APPLY THIS PATCH] :)
This is the patch I used to simulate each possible failure case
in the probing function.
I can say going it was worth it, as I was originally not gating
ida_free, and the struct would corrupt.
Below are the logs from my last run with this.
I added a space between each iteration, to help reading:
[ 76.680204] wiimote 0005:057E:0330.0006: Probing wiimote iteration 1
[ 76.680216] __wiimote_probe_cleanup: wdata NULL
[ 76.680224] wiimote 0005:057E:0330.0006: probe with driver wiimote failed with error -12
[ 81.745168] wiimote 0005:057E:0330.0007: Probing wiimote iteration 2
[ 81.745312] wiimote 0005:057E:0330.0007: probe with driver wiimote failed with error -12
[ 86.869452] wiimote 0005:057E:0330.0008: Probing wiimote iteration 3
[ 86.869935] wiimote 0005:057E:0330.0008: unknown main item tag 0x0
[ 86.869983] wiimote 0005:057E:0330.0008: probe with driver wiimote failed with error -12
[ 92.001194] wiimote 0005:057E:0330.0009: Probing wiimote iteration 4
[ 92.001684] wiimote 0005:057E:0330.0009: unknown main item tag 0x0
[ 92.001905] wiimote 0005:057E:0330.0009: hidraw5: BLUETOOTH HID v0.01 Gamepad [Nintendo RVL-CNT-01-TR] on 64:bc:58:9a:b9:28
[ 92.002075] __wiimote_probe_cleanup: hid_hw_stop cleanup
[ 92.002105] wiimote 0005:057E:0330.0009: probe with driver wiimote failed with error -12
[ 97.129059] wiimote 0005:057E:0330.000A: Probing wiimote iteration 5
[ 97.129528] wiimote 0005:057E:0330.000A: unknown main item tag 0x0
[ 97.129757] wiimote 0005:057E:0330.000A: hidraw5: BLUETOOTH HID v0.01 Gamepad [Nintendo RVL-CNT-01-TR] on 64:bc:58:9a:b9:28
[ 97.129774] __wiimote_probe_cleanup: hid_hw_close cleanup
[ 97.129934] __wiimote_probe_cleanup: hid_hw_stop cleanup
[ 97.129962] wiimote 0005:057E:0330.000A: probe with driver wiimote failed with error -12
[ 102.265442] wiimote 0005:057E:0330.000B: Probing wiimote iteration 6
[ 102.265925] wiimote 0005:057E:0330.000B: unknown main item tag 0x0
[ 102.266521] wiimote 0005:057E:0330.000B: hidraw5: BLUETOOTH HID v0.01 Gamepad [Nintendo RVL-CNT-01-TR] on 64:bc:58:9a:b9:28
[ 102.266538] __wiimote_probe_cleanup: hid_hw_close cleanup
[ 102.266814] __wiimote_probe_cleanup: hid_hw_stop cleanup
[ 102.266844] wiimote 0005:057E:0330.000B: probe with driver wiimote failed with error -12
[ 107.405172] wiimote 0005:057E:0330.000C: Probing wiimote iteration 7
[ 107.405602] wiimote 0005:057E:0330.000C: unknown main item tag 0x0
[ 107.405776] wiimote 0005:057E:0330.000C: hidraw5: BLUETOOTH HID v0.01 Gamepad [Nintendo RVL-CNT-01-TR] on 64:bc:58:9a:b9:28
[ 107.405794] __wiimote_probe_cleanup: hid_hw_close cleanup
[ 107.405953] __wiimote_probe_cleanup: hid_hw_stop cleanup
[ 107.405981] wiimote 0005:057E:0330.000C: probe with driver wiimote failed with error -12
[ 112.525411] wiimote 0005:057E:0330.000D: Probing wiimote iteration 8
[ 112.525883] wiimote 0005:057E:0330.000D: unknown main item tag 0x0
[ 112.526323] wiimote 0005:057E:0330.000D: hidraw5: BLUETOOTH HID v0.01 Gamepad [Nintendo RVL-CNT-01-TR] on 64:bc:58:9a:b9:28
[ 112.526362] __wiimote_probe_cleanup: hid_hw_close cleanup
[ 112.526511] __wiimote_probe_cleanup: hid_hw_stop cleanup
[ 112.526535] wiimote 0005:057E:0330.000D: probe with driver wiimote failed with error -12
[ 117.673238] wiimote 0005:057E:0330.000E: Probing wiimote iteration 9
[ 117.673700] wiimote 0005:057E:0330.000E: unknown main item tag 0x0
[ 117.673885] wiimote 0005:057E:0330.000E: hidraw5: BLUETOOTH HID v0.01 Gamepad [Nintendo RVL-CNT-01-TR] on 64:bc:58:9a:b9:28
[ 117.673909] __wiimote_probe_cleanup: ida cleanup
[ 117.673929] __wiimote_probe_cleanup: hid_hw_close cleanup
[ 117.674081] __wiimote_probe_cleanup: hid_hw_stop cleanup
[ 117.674105] wiimote 0005:057E:0330.000E: probe with driver wiimote failed with error -12
[ 122.805206] wiimote 0005:057E:0330.000F: Probing wiimote iteration 10
[ 122.805669] wiimote 0005:057E:0330.000F: unknown main item tag 0x0
[ 122.805895] wiimote 0005:057E:0330.000F: hidraw5: BLUETOOTH HID v0.01 Gamepad [Nintendo RVL-CNT-01-TR] on 64:bc:58:9a:b9:28
[ 122.805934] wiimote 0005:057E:0330.000F: New device registered (Wiimote 1)
[ 122.805940] __wiimote_probe_cleanup: wdata NULL
[ 122.841287] wiimote 0005:057E:0330.000F: detected device: Nintendo Wii Remote Plus (Gen 2) (1)
[ 122.841759] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0330.000F/input/input33
[ 122.844724] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0330.000F/input/input34
[ 122.845091] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0330.000F/input/input32
[ 122.965128] wiimote 0005:057E:0330.000F: detected extension: Nintendo Wii Motion Plus
[ 122.965276] input: Nintendo Wii Remote Motion Plus as /devices/virtual/misc/uhid/0005:057E:0330.000F/input/input35
[ 127.877355] wiimote 0005:057E:0330.000F: Device removed
[ 130.497046] wiimote 0005:057E:0330.0010: Probing wiimote iteration 11
[ 130.497524] wiimote 0005:057E:0330.0010: unknown main item tag 0x0
[ 130.497838] wiimote 0005:057E:0330.0010: hidraw5: BLUETOOTH HID v0.01 Gamepad [Nintendo RVL-CNT-01-TR] on 64:bc:58:9a:b9:28
[ 130.497869] wiimote 0005:057E:0330.0010: New device registered (Wiimote 1)
[ 130.497874] __wiimote_probe_cleanup: wdata NULL
[ 130.533040] wiimote 0005:057E:0330.0010: detected device: Nintendo Wii Remote Plus (Gen 2) (1)
[ 130.533424] input: Nintendo Wii Remote Accelerometer as /devices/virtual/misc/uhid/0005:057E:0330.0010/input/input37
[ 130.533579] input: Nintendo Wii Remote IR as /devices/virtual/misc/uhid/0005:057E:0330.0010/input/input38
[ 130.533699] input: Nintendo Wii Remote as /devices/virtual/misc/uhid/0005:057E:0330.0010/input/input36
[ 130.641239] wiimote 0005:057E:0330.0010: detected extension: Nintendo Wii Motion Plus
[ 130.641385] input: Nintendo Wii Remote Motion Plus as /devices/virtual/misc/uhid/0005:057E:0330.0010/input/input39
[ 134.317450] wiimote 0005:057E:0330.0010: Device removed
Signed-off-by: Rafael Passos <rafael@rcpassos.me>
---
drivers/hid/hid-wiimote-core.c | 45 ++++++++++++++++++++++++++++++----
1 file changed, 40 insertions(+), 5 deletions(-)
diff --git a/drivers/hid/hid-wiimote-core.c b/drivers/hid/hid-wiimote-core.c
--- a/drivers/hid/hid-wiimote-core.c
+++ b/drivers/hid/hid-wiimote-core.c
@@ -1779,52 +1779,77 @@ static DEFINE_IDA(wiimote_ida);
static void __wiimote_probe_cleanup(struct wiimote_data *wdata)
{
- if (!wdata)
+ if (!wdata) {
+ printk(KERN_INFO "%s: wdata NULL\n", __func__);
return;
+ }
- if (wdata->player_id)
+ if (wdata->player_id){
+ printk(KERN_INFO "%s: ida cleanup\n", __func__);
ida_free(&wiimote_ida, wdata->player_id);
+ }
// safe, debugfs checks IS_ERR_OR_NULL
wiidebug_deinit(wdata);
// safe, checks dev for NULL
device_remove_file(&wdata->hdev->dev, &dev_attr_devtype);
device_remove_file(&wdata->hdev->dev, &dev_attr_extension);
- if (wdata->probe_state & WIIMOTE_PROBE_HW_OPENED)
+ if (wdata->probe_state & WIIMOTE_PROBE_HW_OPENED){
+ printk(KERN_INFO "%s: hid_hw_close cleanup\n", __func__);
hid_hw_close(wdata->hdev);
- if (wdata->probe_state & WIIMOTE_PROBE_HW_STARTED)
+ }
+ if (wdata->probe_state & WIIMOTE_PROBE_HW_STARTED){
hid_hw_stop(wdata->hdev);
+ printk(KERN_INFO "%s: hid_hw_stop cleanup\n", __func__);
+ }
kfree(wdata);
}
DEFINE_FREE(wiimote_probe_cleanup, struct wiimote_data *,
__wiimote_probe_cleanup(_T))
+static int debug_connect_iterate = 0;
+
static int wiimote_hid_probe(struct hid_device *hdev,
const struct hid_device_id *id)
{
int ret;
+ debug_connect_iterate++;
+
+ hid_info(hdev, "Probing wiimote iteration %d\n", debug_connect_iterate);
hdev->quirks |= HID_QUIRK_NO_INIT_REPORTS;
- struct wiimote_data *wdata __free(wiimote_probe_cleanup) = wiimote_create(hdev);
+ struct wiimote_data *wdata __free(wiimote_probe_cleanup) = NULL;
+ if (debug_connect_iterate == 1)
+ return -ENOMEM;
+
+ wdata = wiimote_create(hdev);
if (!wdata) {
hid_err(hdev, "Can't alloc device\n");
return -ENOMEM;
}
+ if (debug_connect_iterate == 2)
+ return -ENOMEM;
+
ret = hid_parse(hdev);
if (ret) {
hid_err(hdev, "HID parse failed\n");
return ret;
}
+ if (debug_connect_iterate == 3)
+ return -ENOMEM;
+
ret = hid_hw_start(hdev, HID_CONNECT_HIDRAW);
if (ret) {
hid_err(hdev, "HW start failed\n");
return ret;
}
wdata->probe_state |= WIIMOTE_PROBE_HW_STARTED;
+ if (debug_connect_iterate == 4)
+ return -ENOMEM;
ret = hid_hw_open(hdev);
if (ret) {
@@ -1832,22 +1857,30 @@ static int wiimote_hid_probe(struct hid_device *hdev,
return ret;
}
wdata->probe_state |= WIIMOTE_PROBE_HW_OPENED;
+ if (debug_connect_iterate == 5)
+ return -ENOMEM;
ret = device_create_file(&hdev->dev, &dev_attr_extension);
if (ret) {
hid_err(hdev, "cannot create sysfs attribute\n");
return ret;
}
+ if (debug_connect_iterate == 6)
+ return -ENOMEM;
ret = device_create_file(&hdev->dev, &dev_attr_devtype);
if (ret) {
hid_err(hdev, "cannot create sysfs attribute\n");
return ret;
}
+ if (debug_connect_iterate == 7)
+ return -ENOMEM;
ret = wiidebug_init(wdata);
if (ret)
return ret;
+ if (debug_connect_iterate == 8)
+ return -ENOMEM;
int player_id = ida_alloc_min(&wiimote_ida, 1, GFP_KERNEL);
if (player_id < 1) {
@@ -1856,6 +1889,8 @@ static int wiimote_hid_probe(struct hid_device *hdev,
return ret;
}
wdata->player_id = player_id;
+ if (debug_connect_iterate == 9)
+ return -ENOMEM;
hid_info(hdev, "New device registered (Wiimote %d)\n", player_id);
--
2.53.0
next prev parent reply other threads:[~2026-07-15 21:35 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-15 21:24 [PATCH v2 0/4] HID: wiimote: new LED behavior on connect, scoped guards, uaf Rafael Passos
2026-07-15 21:24 ` [PATCH v2 1/4] HID: wiimote: turn on the LEDs indicating the controller id Rafael Passos
2026-07-15 21:48 ` sashiko-bot
2026-07-15 21:24 ` [PATCH v2 2/4] HID: wiimote: replace spinlock pairs with scoped_guard Rafael Passos
2026-07-15 21:39 ` sashiko-bot
2026-07-15 21:24 ` [PATCH v2 3/4] HID: wiimote: use scoped cleanup in wiimote and led probes Rafael Passos
2026-07-15 21:35 ` Rafael Passos [this message]
2026-07-15 21:42 ` sashiko-bot
2026-07-15 21:24 ` [PATCH v2 4/4] HID: wiimote: fix uaf when hid events are handled during destroy Rafael Passos
2026-07-15 21:57 ` sashiko-bot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260715213513.3929001-1-rafael@rcpassos.me \
--to=rafael@rcpassos.me \
--cc=bentiss@kernel.org \
--cc=david@readahead.eu \
--cc=jikos@kernel.org \
--cc=jkoolstra@xs4all.nl \
--cc=linux-input@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox