Commit dc3a6472 authored by Vicki Pfau's avatar Vicki Pfau Committed by Wentao Guan
Browse files

HID: hid-steam: Fix use-after-free when detaching device 

stable inclusion
from stable-v6.6.83
commit 026714ec7546de741826324a6a1914c91024d06c
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IBXANC

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=026714ec7546de741826324a6a1914c91024d06c



--------------------------------

[ Upstream commit e53fc232a65f7488ab75d03a5b95f06aaada7262 ]

When a hid-steam device is removed it must clean up the client_hdev used for
intercepting hidraw access. This can lead to scheduling deferred work to
reattach the input device. Though the cleanup cancels the deferred work, this
was done before the client_hdev itself is cleaned up, so it gets rescheduled.
This patch fixes the ordering to make sure the deferred work is properly
canceled.

Reported-by: default avatar <syzbot+0154da2d403396b2bd59@syzkaller.appspotmail.com>
Fixes: 79504249d7e2 ("HID: hid-steam: Move hidraw input (un)registering to work")
Signed-off-by: default avatarVicki Pfau <vi@endrift.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
(cherry picked from commit 026714ec7546de741826324a6a1914c91024d06c)
Signed-off-by: default avatarWentao Guan <guanwentao@uniontech.com>
parent c2b3cac7

drivers/hid/hid-steam.c

+1 −1
Original line number Diff line number Diff line
@@ -1325,11 +1325,11 @@ static void steam_remove(struct hid_device *hdev) 
		return;

	}



	hid_destroy_device(steam->client_hdev);

	cancel_delayed_work_sync(&steam->mode_switch);

	cancel_work_sync(&steam->work_connect);

	cancel_work_sync(&steam->rumble_work);

	cancel_work_sync(&steam->unregister_work);

	hid_destroy_device(steam->client_hdev);

	steam->client_hdev = NULL;

	steam->client_opened = false;

	if (steam->quirks & STEAM_QUIRK_WIRELESS) {