From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794065013; b=nOW3/+ThBxHmw1Ugsf15K2K1UFo8pHMmLTaUT4BIHYg8K9R1JlWXlKssQCmPUX3r8FmG y6/MUcXtJmD0TkPgYFkn3EhrydxFfIjkEe+eITA58DKeaxE1JArJZeE6VMEXiSzUSN+Bk cYPB4lj8bZilxwoFzgYK2EvnTmpMqzWLS3g5Ia/nebjB7gnXqxdSEBNbVXELzi/EBn2Te UYycv4btv1C5IYuETNFCpZKr5fO4UUiO6OY4vej22rPSSOQ+0JWGaIyf2G+s1B0VbPVmA hctczLwTgXUbhs06G+EA9mg7CJV7K6AtSh7KHj0LxSh+X27NjsMd3wdijwoQZhYfWLg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794065013; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=JUBLLY5Y9qwyW9S3R3jvVkLGXN0UlNAQv9w8qs3/Wkw=; b=5n/QOkqMeqlIydjT49clbTgyTp5RwoJY9mhuw6FBQhWP/Erz0QaG/O3if09m2m1QiVa4 KJxmjRqVZC/7f6cithOmVUXYW1omcRW94u7kKDiyjPjonkTtbDaxcfZ7IYxh3Xx9mp9fJ tMaKJQ7YQ850cPawp3GxGWu7PCAyx37s1jO6ctank/9UW837u/kHZiKa2iHpMn5260oNI xa88fXX3+4NCHpFC8k1/8PgMPPIqtFHaFCE+F0cytlOSMTn0CrJX5SKPRqELTXZld+HhE BChTrO0MTj/n/SZbRLqrJuoycYSf279bLM7WfIVBSDc0AzTpwPd+Xj9sd1sWkxTVdsg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=K9UyGoJx; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 92660606A33D; Sat, 7 Nov 2026 15:23:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=K9UyGoJx Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0A5901F0089F; Sat, 7 Nov 2026 15:23:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794065013; bh=JUBLLY5Y9qwyW9S3R3jvVkLGXN0UlNAQv9w8qs3/Wkw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=K9UyGoJxeVit5kPkeWYf9BGMa3ZFA/AOz+PvqYbUo2WE7NybEBqHY4IcT2nrsvHF1 SpcrwYT6D1/IQQzqbPKeX9raOsh2cxdl8HMC9OgNAFzUtbK2QE2/Invj/WnU6/nhRs jZJ/7mQluG+t2LiFAHYCe/ugwj15kgvBIWecHcYk= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, syzbot+0f98b0c0bdeaab2dc2fd@syzkaller.appspotmail.com, Sanan Hasanov , Guenter Roeck , Sasha Levin Subject: [PATCH 7.3 0874/1257] hwmon: (corsair-cpro) Make wait_input_report_lock IRQ safe Date: Sat, 7 Nov 2026 08:52:50 -0500 Message-ID: <20261107135003.466238582@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134939.434104957@linuxfoundation.org> References: <20261107134939.434104957@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sanan Hasanov [ Upstream commit e4fdc82f55cf0e3d5df5c88278da5baa76a109d1 ] ccp_raw_event() is the HID ->raw_event() callback and takes wait_input_report_lock with a plain spin_lock(). This callback can run in very different contexts depending on the transport: from process context (e.g. uhid, via a write() to /dev/uhid) with softirqs and interrupts enabled, and from URB completion, which is softirq context for HCDs using HCD_BH and hard interrupt context for HCDs that do not (e.g. OHCI, UHCI). Taking the lock from process context with softirqs enabled while the same lock is also taken from softirq context can deadlock if the softirq interrupts the lock holder on the same CPU. Lockdep reports: WARNING: inconsistent lock state inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. ... spin_lock include/linux/spinlock.h:347 [inline] ccp_raw_event+0x51/0x110 drivers/hwmon/corsair-cpro.c:161 __hid_input_report+0x41c/0x580 drivers/hid/hid-core.c:2175 hid_irq_in+0x492/0x710 drivers/hid/usbhid/hid-core.c:287 __usb_hcd_giveback_urb+0x378/0x540 drivers/usb/core/hcd.c:1657 dummy_timer+0xa91/0x4cc0 drivers/usb/gadget/udc/dummy_hcd.c:2023 For the same reason, the spin_lock_bh() in send_usb_cmd() is not sufficient when ccp_raw_event() is called from hard interrupt context. Use spin_lock_irqsave() in ccp_raw_event(), since it may be called with interrupts already disabled, and spin_lock_irq() in send_usb_cmd(), which always runs in process context. Fixes: d02abd57e794 ("hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock") Reported-by: syzbot+0f98b0c0bdeaab2dc2fd@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0f98b0c0bdeaab2dc2fd Cc: stable@vger.kernel.org Signed-off-by: Sanan Hasanov Link: https://patch.msgid.link/20261008205310.30832-1-sanan.hasanou@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Sasha Levin --- drivers/hwmon/corsair-cpro.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/hwmon/corsair-cpro.c b/drivers/hwmon/corsair-cpro.c index c096451526132..e6d31d3676980 100644 --- a/drivers/hwmon/corsair-cpro.c +++ b/drivers/hwmon/corsair-cpro.c @@ -135,9 +135,9 @@ static int send_usb_cmd(struct ccp_device *ccp, u8 command, u8 byte1, u8 byte2, * the raw event parsing and marked the ccp->wait_input_report * completion as done. */ - spin_lock_bh(&ccp->wait_input_report_lock); + spin_lock_irq(&ccp->wait_input_report_lock); reinit_completion(&ccp->wait_input_report); - spin_unlock_bh(&ccp->wait_input_report_lock); + spin_unlock_irq(&ccp->wait_input_report_lock); ret = hid_hw_output_report(ccp->hdev, ccp->cmd_buffer, OUT_BUFFER_SIZE); if (ret < 0) @@ -156,15 +156,16 @@ static int send_usb_cmd(struct ccp_device *ccp, u8 command, u8 byte1, u8 byte2, static int ccp_raw_event(struct hid_device *hdev, struct hid_report *report, u8 *data, int size) { struct ccp_device *ccp = hid_get_drvdata(hdev); + unsigned long flags; /* only copy buffer when requested */ - spin_lock(&ccp->wait_input_report_lock); + spin_lock_irqsave(&ccp->wait_input_report_lock, flags); if (!completion_done(&ccp->wait_input_report)) { memcpy(ccp->buffer, data, min(IN_BUFFER_SIZE, size)); ccp->buffer_recv_size = size; complete_all(&ccp->wait_input_report); } - spin_unlock(&ccp->wait_input_report_lock); + spin_unlock_irqrestore(&ccp->wait_input_report_lock, flags); return 0; } -- 2.53.0