Re: [PATCH 1/2] HID: intel-thc-hid: quickspi: quiesce IRQs during teardown

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] hid: intel-thc-hid: DMA UAF due to HID deregistration race in remove
--

commit 664b72e58bd5cb1485c8eb563326dab08180f916
Author: Myeonghun Pak <mhun512@gmail.com>

HID: intel-thc-hid: quickspi: quiesce IRQs during teardown

This commit disables and synchronizes the IRQ and drains recovery work prior
to freeing the IRQ and releasing HID/DMA resources. It introduces this ordered
teardown in both the probe error and remove paths.

Link: https://lore-kernel.gnuweeb.org/linux-input/20260717035609.3874015-1-even.xu@intel.com/T/
Link: https://patchew.org/linux/20260729050145.2272597-1-even.xu@intel.com/

> diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
> index 53023e30cf8d4..c67476a378573 100644
> --- a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
> +++ b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
[ ... ]
> @@ -721,9 +731,12 @@ static void quickspi_remove(struct pci_dev *pdev)
>  	if (!qsdev)
>  		return;
>  
> -	quickspi_hid_remove(qsdev);
> -
> +	WRITE_ONCE(qsdev->recovery_disabled, true);
> +	disable_irq(pdev->irq);
>  	quickspi_dev_deinit(qsdev);
> +	devm_free_irq(&pdev->dev, pdev->irq, qsdev);
> +
> +	quickspi_hid_remove(qsdev);

[Severity: High]
Does this sequence open a race window for a hardware DMA use-after-free?

By tearing down the hardware and disabling interrupts before unregistering the
HID device, it appears userspace can still issue a request via hidraw during
unbind.

If a raw_request is queued on the disabled device, it may call thc_dma_write()
to submit a TxDMA request:

drivers/hid/intel-thc-hid/intel-thc/intel-thc-dma.c:thc_dma_write() {
    ...
	ret = wait_event_interruptible_timeout(dev->write_complete_wait, dev->write_done, 1 * HZ);
	if (ret <= 0 || !dev->write_done) {
		dev_err_once(dev->dev, "timeout for waiting TxDMA completion\n");
		ret = -ETIMEDOUT;
		goto end;
	}
    ...
}

Because IRQs are disabled here, the wait will time out and return -ETIMEDOUT,
but it fails to clear the TxDMA START bit.

quickspi_remove() will then proceed to unregister the HID device and call
quickspi_dma_deinit(), which frees the DMA buffers without clearing the TxDMA
START bit. Could this allow the hardware TxDMA engine to remain active and
access freed DMA memory, leading to memory corruption or an IOMMU fault?

Note that follow-up patches in the series do not appear to resolve this race.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261011220531.2073892-1-mhun512@gmail.com?part=1