From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f172.google.com (mail-pg1-f172.google.com [209.85.215.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D12872874F5 for ; Tue, 4 Aug 2026 00:49:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785804580; cv=none; b=Mk8ovBOXsaiqY19ZzZw/PFNdtXeLxcFhculiA7kq93BR0f87RpFBsFrzNL2kJ2VBLOoys3m1sSSxm7Wi/bSKxkEWo+/p6c/SyxRZlnCAznPY6SCi5kJ2MzM+IO637h1yzJu12SOhC8HXm03TxLWRofYu7FUDsVciwYeKsnMRQQU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785804580; c=relaxed/simple; bh=oa+H6nWC+O0SGtuz+1s7AAMO0NBQhgXa1uTfnS6jUk4=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=ltBqxAy79/rmVo3wKbOBCvQhqQKfOvJOIcKFLKOd03z0VkatOTIZpAwLc1J9AiK+A3yTzNk+1FLUrzCMp3J0AKFOkauSsMPGI+PsxjBU/+ZGOSt1GMRHFHGEiQK8nHIMBWPw/BXnpHUbZYQXTgWS9jgb7EENMCcq3BTdzwGle64= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=O3QoWO+y; arc=none smtp.client-ip=209.85.215.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="O3QoWO+y" Received: by mail-pg1-f172.google.com with SMTP id 41be03b00d2f7-c9b373d5af0so3087208a12.2 for ; Mon, 03 Aug 2026 17:49:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785804578; x=1786409378; darn=vger.kernel.org; h=in-reply-to:content-transfer-encoding:content-disposition :content-type:mime-version:references:message-id:subject:cc:to:from :date:from:to:cc:subject:date:message-id:reply-to:content-type; bh=7vHz5OIbygjwNdyPf22CXsjNKdQWVu+Ycy4+8mUpd8A=; b=O3QoWO+yq4TphsvWi3Mp8Ybbh/womT5q8Z0yh6gxeC1OOxqvkKjo8h74vYw2aJvdhc wS88Ggka+F/1WqkX+GNPUEYL5BGUwQxrKROUm6e9XNRa/kQ+xZVCnLXyqcAnXsfOdfEu rZQ/8eGvmINH3uRX5k7ClGg7WyhZ+4vj80AhmCgFEiyymZB2dTDHmA65/SaS1AB7g8cV 8iKJHEXgIDFVXHeQeQitTcqAGIZ2ql7H6zN44aYMFVafhr32grTlPU4gb8vNw9M9Q/Gr /5u6Icft6kRfjZoznJkC+9h2FQp8U948A2fFl4xDk2EdlZ0KxfREP6nhcfy3sBI74veM oAoQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785804578; x=1786409378; h=in-reply-to:content-transfer-encoding:content-disposition :content-type:mime-version:references:message-id:subject:cc:to:from :date:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=7vHz5OIbygjwNdyPf22CXsjNKdQWVu+Ycy4+8mUpd8A=; b=cczYPf/c5nX0MuxnsHP1ZOaDHZ5PN30djKxwtxE/q8d2+2i0vVXXia1g0QzB8M/otX 56I0AsGErsXO9v3i3Ej3va0f5NNds+AKHgcXtBJqHdNp74ai3Y+9TFXutygrlsauQTWC gMsorl8M+M3fjxDEgBHoSUH1YPMGCGqlcbg093uDMN/ORca4g3454IcA6KoG7RxmCkWI QMmEB7VwBQp751oJQnwWYvmyZvWFnAgoIKS2gmE+sESsRnvIcIrlKiHjWvCkvIFIKxdJ r7IK8QvydDK7yeOXJ0iFtfSKZD7G7K2VgE/aCMpnI62/11O5kml5L5qA4bcFcIyUIVGX 33aA== X-Forwarded-Encrypted: i=1; AHgh+Ro2tDHodJFlWuHq7eYpoI0bT6+H8E4WVC1COijsZfKzQYsDJ5JL6xUJSHIABEbalAkzu+3fdcRmlYkHPpc=@vger.kernel.org X-Gm-Message-State: AOJu0Yx430PYaL4ejjVaBntMsKEk8aqJH9RukzDoPoRp3EF2ALlbEhxc RKECnHPrtE5HpQ4rnyJ8X3f52lDWJwsf7ZF5jC1kw59keWk/JjmXAhwO X-Gm-Gg: AR+sD13zmc//yLSh08bol6sfFYb3Czl2Cv1AgBV85eHFY88EBqj366If2W6iXHc9Fk9 yqw++P4PZmg7Xevx7TauiUP+XR7AsMKlnuq25WuqIJcnEt1hNKLdZ1ZpeGBhWv/5HaWr+ZvRy1D z9ygptlVfIZX/V6AYIesHoQ3kkVOsjOy2wgQI9FXFUCOsD/DOh3QDHjGrFxenDNbpITk6bgcGfu VOpl3H9/KwLx7XENdvkBtzdZ86s0nGvVW8q0gt2r8xlIhQS1xjcdiBgzHVmKwKvd6ecnAS3jIgw JXWd3ZGQ6siz1XNfMMGS5684i+lHIPLS12z9xfY+XW4vCyxUb1ZBve2b1yhxzbdoWgQFCtVVprC pr9aQkNaERBZ8WNKl9du/T2FBl81DTRfQO0IqWTuu6uiHPk3MRg8ytXQ1k2X8nOcA2QcSTcSTEI Iqa0w9KKaRHZ1TZ2+jNUziRCc0zcJk/q49CEymLWiwoG/aTMYEnEm+RREDHTmLqz4lcjPH5KYKl QNn+uGif9kBne30fnbveh6UdCgkxQ== X-Received: by 2002:a05:6a21:6cc4:b0:3c3:7fa2:9618 with SMTP id adf61e73a8af0-3c92a89bebamr11916363637.37.1785804578109; Mon, 03 Aug 2026 17:49:38 -0700 (PDT) Received: from google.com ([2a00:79e0:2ebe:8:d109:cdba:8a20:74ad]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3153dd4f0f0sm41716849eec.2.2026.08.03.17.49.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 03 Aug 2026 17:49:37 -0700 (PDT) Date: Mon, 3 Aug 2026 17:49:34 -0700 From: Dmitry Torokhov To: Shengzhuo Wei Cc: "Derek J. Clark" , Jiri Kosina , Benjamin Tissoires , Zhouwang Huang , linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH] HID: hid-oxp: fix UAF on pending work in remove() Message-ID: References: <20260804-oxp-fix-v1-1-51a4fe787167@cherr.cc> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: On Tue, Aug 04, 2026 at 07:54:57AM +0800, Shengzhuo Wei wrote: > On 2026-08-03 16:33, Dmitry Torokhov wrote: > > > What stops these jobs from re-arming? Should it use > > disable_delayed_work_sync() instead? > > Agreed — cancel_delayed_work_sync() only drains the running instance; it > doesn't stop the works from being re-queued from the raw_event / sysfs / > LED-brightness paths before the device is fully torn down, so the UAF > window isn't closed. I'll switch all three calls to > disable_delayed_work_sync() in v2. > > Do you have any other comments you'd like addressed in v2? Since you are addressing work-related UAF, fixing it on probe failures would be nice (Sashiko mentioned it). The other Sahiko comment regarding global instance would be nice to get fixed as well (but separate patch and only if you have time/inclination). Another potential change is not to create device attribute group by hand but attach it to the driver structure so it is created and torn down automatically, and control visibility of the attributes through is_visible() method. Thanks. -- Dmitry