From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7158F2F8E90; Tue, 25 Aug 2026 14:01:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787666483; cv=none; b=qw2fg8JC319mDv28wNt8jpWwrXdUUBOLmt20tY/2aeoZVQXAzW4B2gQvtyGjsbJpG5HUMLxc1VIXRX0CD8MfnS7Wq9SX+GFz6SzARyiwQoP58HGlnv+TQ1lWKy615SrlYCbt7sBn6hOJRwEUCVvfNyHR6tCkbkL10fAuo6+6+q4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787666483; c=relaxed/simple; bh=YwuUweP32MJmgt+kg8McJJihpIGxSF7wEa8oWlEq3kA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=lzS/LTj+a7kBZfYv38qOwcZXTObT0/W9/ZeUkPhMVT+XCodvu1vxv3Nd6g5Q700QTBWow3dg6ETuiR+/nk6qzYOpluTWY45WkyNXUapKXjqtgyRBZwTWwfwd8ZKI1ogJlXToQ37po+0BqUDFZxUAsORt8UF5D3DVSX23oi3yzlk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0XdKFRii; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="0XdKFRii" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C16771F000E9; Tue, 25 Aug 2026 14:01:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1787666482; bh=Y7yQZEr5T/1VqR3Xq9J0Ra7MdAYrYxILmKr+dZcuhSA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=0XdKFRiiul25EAxJKdF6TCciUmIVJAScaSzYiYEDNKzMD/nFlazIbUO1oyM5W/Uo1 u+KhnC5oIgVFnl964AnLhf9SIjs7jR9tuBV6nCMFfoTWwmdl6TbFMBfTKcxDepowPo uDPgHrlhj4m1Xs56AOvZhYKjrVV+d2e0BaSNvGGE= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Sashiko AI Review , Haoxiang Li , Srinivas Pandruvada , Jiri Kosina Subject: [PATCH 5.10 56/57] HID: sensor: custom: Fix use-after-free in enable_sensor Date: Tue, 25 Aug 2026 15:27:18 +0200 Message-ID: <20260825132543.529407147@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260825132541.342390421@linuxfoundation.org> References: <20260825132541.342390421@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Haoxiang Li commit ad8fb82b04422f49530d2aa2753cc81d1c60102c upstream. enable_sensor_store() can call set_power_report_state(), which dereferences sensor_inst->power_state and sensor_inst->report_state. These pointers refer to entries in sensor_inst->fields. Create the field attributes before exposing the enable_sensor sysfs attribute, so enable_sensor cannot be accessed before the state it depends on has been initialized. On remove, delete enable_sensor before freeing the field attributes, so a concurrent sysfs write cannot dereference freed memory through power_state or report_state. Reported-by: Sashiko AI Review Link: https://sashiko.dev/#/patchset/20260623021950.1736413-1-haoxiang_li2024@163.com?part=1 Fixes: 4a7de0519df5 ("HID: sensor: Custom and Generic sensor support") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Acked-by: Srinivas Pandruvada Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman --- drivers/hid/hid-sensor-custom.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) --- a/drivers/hid/hid-sensor-custom.c +++ b/drivers/hid/hid-sensor-custom.c @@ -771,26 +771,26 @@ static int hid_sensor_custom_probe(struc return ret; } - ret = sysfs_create_group(&sensor_inst->pdev->dev.kobj, - &enable_sensor_attr_group); + ret = hid_sensor_custom_add_attributes(sensor_inst); if (ret) goto err_remove_callback; - ret = hid_sensor_custom_add_attributes(sensor_inst); + ret = sysfs_create_group(&sensor_inst->pdev->dev.kobj, + &enable_sensor_attr_group); if (ret) - goto err_remove_group; + goto err_remove_attributes; ret = hid_sensor_custom_dev_if_add(sensor_inst); if (ret) - goto err_remove_attributes; + goto err_remove_group; return 0; -err_remove_attributes: - hid_sensor_custom_remove_attributes(sensor_inst); err_remove_group: sysfs_remove_group(&sensor_inst->pdev->dev.kobj, &enable_sensor_attr_group); +err_remove_attributes: + hid_sensor_custom_remove_attributes(sensor_inst); err_remove_callback: sensor_hub_remove_callback(hsdev, hsdev->usage); @@ -803,9 +803,10 @@ static int hid_sensor_custom_remove(stru struct hid_sensor_hub_device *hsdev = pdev->dev.platform_data; hid_sensor_custom_dev_if_remove(sensor_inst); - hid_sensor_custom_remove_attributes(sensor_inst); + /* Remove enable_sensor first as it uses fields via power_state/report_state. */ sysfs_remove_group(&sensor_inst->pdev->dev.kobj, &enable_sensor_attr_group); + hid_sensor_custom_remove_attributes(sensor_inst); sensor_hub_remove_callback(hsdev, hsdev->usage); return 0;