From: "Günther Noack" <gnoack@google.com>
To: Lee Jones <lee@kernel.org>
Cc: "Filipe Laíns" <lains@riseup.net>,
"Bastien Nocera" <hadess@hadess.net>,
"Jiri Kosina" <jikos@kernel.org>,
"Benjamin Tissoires" <bentiss@kernel.org>,
linux-input@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 1/1] HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure
Date: Tue, 3 Mar 2026 10:35:53 +0100 [thread overview]
Message-ID: <aaareetB3Hhd6xgI@google.com> (raw)
In-Reply-To: <20260227100939.961011-1-lee@kernel.org>
On Fri, Feb 27, 2026 at 10:09:38AM +0000, Lee Jones wrote:
> Presently, if the force feedback initialisation fails when probing the
> Logitech G920 Driving Force Racing Wheel for Xbox One, an error number
> will be returned and propagated before the userspace infrastructure
> (sysfs and /dev/input) has been torn down. If userspace ignores the
> errors and continues to use its references to these dangling entities, a
> UAF will promptly follow.
>
> We have 2 options; continue to return the error, but ensure that all of
> the infrastructure is torn down accordingly or continue to treat this
> condition as a warning by emitting the message but returning success.
> It is thought that the original author's intention was to emit the
> warning but keep the device functional, less the force feedback feature,
> so let's go with that.
>
> Signed-off-by: Lee Jones <lee@kernel.org>
> ---
> drivers/hid/hid-logitech-hidpp.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
> index e871f1729d4b..eee9ab6a2fc4 100644
> --- a/drivers/hid/hid-logitech-hidpp.c
> +++ b/drivers/hid/hid-logitech-hidpp.c
> @@ -4487,10 +4487,12 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
> if (!ret)
> ret = hidpp_ff_init(hidpp, &data);
>
> - if (ret)
> + if (ret) {
> hid_warn(hidpp->hid_dev,
> "Unable to initialize force feedback support, errno %d\n",
> ret);
> + ret = 0;
> + }
> }
>
> /*
> --
> 2.53.0.473.g4a7958ca14-goog
>
Reviewed-by: Günther Noack <gnoack@google.com>
Thanks for the patch!
—Günther
next prev parent reply other threads:[~2026-03-03 9:36 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-02-27 10:09 [PATCH 1/1] HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure Lee Jones
2026-03-03 9:35 ` Günther Noack [this message]
2026-03-16 15:11 ` Lee Jones
2026-03-16 15:30 ` Benjamin Tissoires
2026-03-17 9:17 ` Lee Jones
2026-03-16 15:59 ` (subset) " Benjamin Tissoires
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aaareetB3Hhd6xgI@google.com \
--to=gnoack@google.com \
--cc=bentiss@kernel.org \
--cc=hadess@hadess.net \
--cc=jikos@kernel.org \
--cc=lains@riseup.net \
--cc=lee@kernel.org \
--cc=linux-input@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox