From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B6D3031F984 for ; Tue, 25 Aug 2026 10:58:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787655508; cv=none; b=CpY/HprB/9noLfsNKbyRJeiMwx7iXX6KYInt/arQoBka9f6ojVF2FXEGux9dRxL/ghkTsnqTrWvawwLiw0mV3RR3rVbx+e/hNY+4lHfKUpzdiNjrb2n8yyyxa6Ox+Wn2Tz3760yosozIosyBBBOun5RYTHfz5t+LK59qImjCCKE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787655508; c=relaxed/simple; bh=/IkyAw7tGy1r1aCHhFxk8NvhgU9F8k9n4pyN6kUwMhQ=; h=Subject:To:Cc:From:Date:Message-ID:MIME-Version:Content-Type; b=PEBTWyYMx7HWjak8RlBwXzq4YB6x2WiKB4IRM6qYje+McHBdt7CeJCHJ9Ld57qDgW89/MpyoIeWm0+dAT59cr34r7o+zlHjY964EveTEeRyEbyZgwIfGH95Dy7mUYNlEWjei2J/Qvi0nbq8LfAtXSlIQ1ZpXvx/m1WAZXTKbVv8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ui87sKJk; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="ui87sKJk" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CB35B1F000E9; Tue, 25 Aug 2026 10:58:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1787655506; bh=duGdI/yLMhLlpv3GxJhLcn7VeVbX2nTFuOkF8mHPQUM=; h=Subject:To:Cc:From:Date; b=ui87sKJk6FmuenHCofL2nzB9fnlvfzQEmFtJnV2IzP6zW0UkgqmwfSW6Aol8Bt/bl 1WfhQuWgvK621pHmSa/G1O5HjLUH37eU3HwLIO2wElrbhAzQ19/vQs+N3Wj3VMlkJG NSEE3E2glHPyNTu1f9nKrV3JJHNEBa0e3DI9PUbM= Subject: FAILED: patch "[PATCH] HID: magicmouse: do not keep a stale msc->input if no input" failed to apply to 5.10-stable tree To: pepemontfort@gmail.com,jkosina@suse.com,signshop.alec@gmail.com Cc: From: Date: Tue, 25 Aug 2026 12:58:03 +0200 Message-ID: <2026082503-contort-glorified-efe1@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The patch below does not apply to the 5.10-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y git checkout FETCH_HEAD git cherry-pick -x 0af3b89705688af01aa06025b84fa7a1e06ba6cc # git commit -s git send-email --to '' --in-reply-to '2026082503-contort-glorified-efe1@gregkh' --subject-prefix 'PATCH 5.10.y' 'HEAD^..' Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 0af3b89705688af01aa06025b84fa7a1e06ba6cc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jose=20Villase=C3=B1or=20Montfort?= Date: Tue, 28 Jul 2026 22:15:57 -0600 Subject: [PATCH] HID: magicmouse: do not keep a stale msc->input if no input is claimed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit magicmouse_input_mapping() caches the first hid_input's input_dev in msc->input while the report descriptor is parsed, and the rest of the driver treats a non-NULL msc->input as proof that an input device was registered. That does not hold on the hid-input error path. If hidinput_connect() fails -- for instance because input_register_device() returns an error -- it unwinds through hidinput_disconnect(), which frees every input_dev it created, including the one cached in msc->input. The failure does not abort the probe. hid_connect() only skips the claim: if ((connect_mask & HID_CONNECT_HIDINPUT) && !hidinput_connect(hdev, connect_mask & HID_CONNECT_HIDINPUT_FORCE)) hdev->claimed |= HID_CLAIMED_INPUT; and the "device has no listeners" bailout below it does not fire for this driver, which sets ->raw_event; on the USB Magic Mouse 2 / Magic Trackpad 2 paths hidraw and hiddev are claimed as well. hid_hw_start() therefore returns 0 and magicmouse_probe() continues with msc->input pointing at freed memory. Being non-NULL, it passes the "input not registered" check in probe and the NULL checks in ->raw_event and ->event, so the next input report dereferences freed memory. Clear msc->input when the HID core did not claim an input device, so the existing NULL checks cover this case as well. Fixes: f1a9a149abc8 ("HID: magicmouse: fix race between input_register() and probe()") Link: https://lore.kernel.org/linux-input/20260728185542.65F091F000E9@smtp.kernel.org/ Cc: stable@vger.kernel.org Signed-off-by: Jose Villaseñor Montfort Reviewed-by: Alec Hall Tested-by: Alec Hall Signed-off-by: Jiri Kosina diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c index 97562765a01d..d2f95658a383 100644 --- a/drivers/hid/hid-magicmouse.c +++ b/drivers/hid/hid-magicmouse.c @@ -915,6 +915,16 @@ static int magicmouse_probe(struct hid_device *hdev, return ret; } + /* + * When hidinput_connect() fails it frees every input device it + * created, but that does not fail hid_hw_start(): the core simply + * does not claim an input. msc->input, cached in ->input_mapping + * while the report descriptor was parsed, would then be a dangling + * pointer that passes every NULL check. Trust the core's claim. + */ + if (!(hdev->claimed & HID_CLAIMED_INPUT)) + msc->input = NULL; + if (is_usb_magicmouse2(id->vendor, id->product) || is_usb_magictrackpad2(id->vendor, id->product)) { timer_setup(&msc->battery_timer, magicmouse_battery_timer_tick, 0);