[STABLE v6.18-v6.6][PATCH] HID: logitech-hidpp: fix race condition when accessing stale stack pointer

[STABLE v6.18-v6.6][PATCH] HID: logitech-hidpp: fix race condition when accessing stale stack pointer

[Lee Jones]

Dear Stable,

On Thu, 09 Apr 2026, Jiri Kosina wrote:

> On Wed, 1 Apr 2026, Benoit Sevens wrote:
> 
> > From: Beno=C3=AEt Sevens <bsevens@google.com>
> > 
> > The driver uses hidpp->send_receive_buf to point to a stack-allocated
> > buffer in the synchronous command path (__do_hidpp_send_message_sync).
> > However, this pointer is not cleared when the function returns.
> > 
> > If an event is processed (e.g. by a different thread) while the
> > send_mutex is held by a new command, but before that command has
> > updated send_receive_buf, the handler (hidpp_raw_hidpp_event) will
> > observe that the mutex is locked and dereference the stale pointer.
> > 
> > This results in an out-of-bounds access on a different thread's kernel
> > stack (or a NULL pointer dereference on the very first command).
> > 
> > Fix this by:
> > 1. Clearing hidpp->send_receive_buf to NULL before releasing the mutex
> >    in the synchronous command path.
> > 2. Moving the assignment of the local 'question' and 'answer' pointers
> >    inside the mutex_is_locked() block in the handler, and adding
> >    a NULL check before dereferencing.
> 
> Now applied.
> 
> Benjamin had some ideas on further cleanup (allocating with __free__ 
> instead of using stack pointer), but that'd be a little bigger cleanup, so 
> let's keep that separate.

Please could we have this commit backported through to linux-6.6.y.

e2aaf2d3ad92 ("HID: logitech-hidpp: fix race condition when accessing stale stack pointer")

I will follow-up with a backported version for the older releases.

-- 
Lee Jones

Re: [STABLE v6.18-v6.6][PATCH] HID: logitech-hidpp: fix race condition when accessing stale stack pointer

[Greg KH]

On Tue, Sep 22, 2026 at 08:54:00AM +0100, Lee Jones wrote:
> Dear Stable,
> 
> On Thu, 09 Apr 2026, Jiri Kosina wrote:
> 
> > On Wed, 1 Apr 2026, Benoit Sevens wrote:
> > 
> > > From: Beno=C3=AEt Sevens <bsevens@google.com>
> > > 
> > > The driver uses hidpp->send_receive_buf to point to a stack-allocated
> > > buffer in the synchronous command path (__do_hidpp_send_message_sync).
> > > However, this pointer is not cleared when the function returns.
> > > 
> > > If an event is processed (e.g. by a different thread) while the
> > > send_mutex is held by a new command, but before that command has
> > > updated send_receive_buf, the handler (hidpp_raw_hidpp_event) will
> > > observe that the mutex is locked and dereference the stale pointer.
> > > 
> > > This results in an out-of-bounds access on a different thread's kernel
> > > stack (or a NULL pointer dereference on the very first command).
> > > 
> > > Fix this by:
> > > 1. Clearing hidpp->send_receive_buf to NULL before releasing the mutex
> > >    in the synchronous command path.
> > > 2. Moving the assignment of the local 'question' and 'answer' pointers
> > >    inside the mutex_is_locked() block in the handler, and adding
> > >    a NULL check before dereferencing.
> > 
> > Now applied.
> > 
> > Benjamin had some ideas on further cleanup (allocating with __free__ 
> > instead of using stack pointer), but that'd be a little bigger cleanup, so 
> > let's keep that separate.
> 
> Please could we have this commit backported through to linux-6.6.y.
> 
> e2aaf2d3ad92 ("HID: logitech-hidpp: fix race condition when accessing stale stack pointer")
> 
> I will follow-up with a backported version for the older releases.

Now queued up, thanks.

greg k-h