From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DE4382E093A; Mon, 20 Apr 2026 16:04:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776701097; cv=none; b=erbQ/m5Kg5QpMXMstx2N3WFeZzLvUdYbdAsAelU+qSigsWctHT/+IiPKuhLrD/17dzoeQKRVRM0nuSLXkIb534iWyPlY7zqKCkF6a/d4sw4Ze48SEgfH6pyQY+aAiXZFxEhLlP4QSacxk/0wEZ+o+MhFF384Nfqb+9Ciopbsf5w= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776701097; c=relaxed/simple; bh=j4TaddyPgC2Wa3daJO9K875m3Ok5NXVBpademJOg/dw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=gipGcuoNM3/NlD8hZ61ZhqKdkHfP7dkFb6XROgAknj+M9pQKlZhKXO4t1bkJxlmK5YSd9EY+SlShtRjKYndjf6+aUWZl8naxJRIC4JsDNgjsIH6tyfZb4XQK4ivhyUZ4TTlEKcQeFhM5X9gz2zw7din/u2TW8J3RGfEeg/NhCwA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=dHAe4uKS; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="dHAe4uKS" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 74130C2BCB4; Mon, 20 Apr 2026 16:04:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1776701097; bh=j4TaddyPgC2Wa3daJO9K875m3Ok5NXVBpademJOg/dw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dHAe4uKSKDt4vWy+iKChvFr7+i7GXXcdAat1sYoo/gNbZjhrvLXhYGaULyWnyqQZZ 6yVHQpHDcLhdPH2VIa6y5KA5DM+LTzTCMTPohxlzgtFCC2Kvkap/KCtltKhQviEm+t /1Xsl5u2mlp+OhBSpv1qxiYQkxfSgFA6A4dMcVnw= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, stable , Michael Zimmermann Subject: [PATCH 6.18 148/198] usb: gadget: f_hid: dont call cdev_init while cdev in use Date: Mon, 20 Apr 2026 17:42:07 +0200 Message-ID: <20260420153940.938355350@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260420153935.605963767@linuxfoundation.org> References: <20260420153935.605963767@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Michael Zimmermann commit 81ebd43cc0d6d106ce7b6ccbf7b5e40ca7f5503d upstream. When calling unbind, then bind again, cdev_init reinitialized the cdev, even though there may still be references to it. That's the case when the /dev/hidg* device is still opened. This obviously unsafe behavior like oopes. This fixes this by using cdev_alloc to put the cdev on the heap. That way, we can simply allocate a new one in hidg_bind. Closes: https://lore.kernel.org/linux-usb/CAN9vWDKZn0Ts5JyV2_xcAmbnBEi0znMLg_USMFrShRryXrgWGQ@mail.gmail.com/T/#m2cb0dba3633b67b2a679c98499508267d1508881 Cc: stable Signed-off-by: Michael Zimmermann Link: https://patch.msgid.link/20260327192209.59945-1-sigmaepsilon92@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/usb/gadget/function/f_hid.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) --- a/drivers/usb/gadget/function/f_hid.c +++ b/drivers/usb/gadget/function/f_hid.c @@ -106,7 +106,7 @@ struct f_hidg { struct list_head report_list; struct device dev; - struct cdev cdev; + struct cdev *cdev; struct usb_function func; struct usb_ep *in_ep; @@ -749,8 +749,9 @@ static int f_hidg_release(struct inode * static int f_hidg_open(struct inode *inode, struct file *fd) { + struct kobject *parent = inode->i_cdev->kobj.parent; struct f_hidg *hidg = - container_of(inode->i_cdev, struct f_hidg, cdev); + container_of(parent, struct f_hidg, dev.kobj); fd->private_data = hidg; @@ -1277,8 +1278,12 @@ static int hidg_bind(struct usb_configur } /* create char device */ - cdev_init(&hidg->cdev, &f_hidg_fops); - status = cdev_device_add(&hidg->cdev, &hidg->dev); + hidg->cdev = cdev_alloc(); + if (!hidg->cdev) + goto fail_free_all; + hidg->cdev->ops = &f_hidg_fops; + + status = cdev_device_add(hidg->cdev, &hidg->dev); if (status) goto fail_free_all; @@ -1580,7 +1585,7 @@ static void hidg_unbind(struct usb_confi { struct f_hidg *hidg = func_to_hidg(f); - cdev_device_del(&hidg->cdev, &hidg->dev); + cdev_device_del(hidg->cdev, &hidg->dev); destroy_workqueue(hidg->workqueue); usb_free_all_descriptors(f); }