linux-kernel - Re: [PATCH] Input: psmouse - fix cleaning up SMBus companions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20170403160713.GB1715@mail.corp.redhat.com>
Date:   Mon, 3 Apr 2017 18:07:13 +0200
From:   Benjamin Tissoires <benjamin.tissoires@...hat.com>
To:     Dmitry Torokhov <dmitry.torokhov@...il.com>
Cc:     linux-input@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] Input: psmouse - fix cleaning up SMBus companions

On Apr 01 2017 or thereabouts, Dmitry Torokhov wrote:
> When trying to destroy platform data after destruction of SMbus companion,
> we need to make sure that we are actually dealing with an SMB companion
> device, and not some random I2C client device.
> 
> Fixes: 8eb92e5c9133 ("Input: psmouse - add support for SMBus companions")
> Reported-by: Benjamin Tissoires <benjamin.tissoires@...hat.com>
> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@...il.com>
> ---

Thanks for the fix!

Tested-by: Benjamin Tissoires <benjamin.tissoires@...hat.com>

Cheers,
Benjamin

>  drivers/input/mouse/psmouse-smbus.c | 30 +++++++++++++++++++-----------
>  1 file changed, 19 insertions(+), 11 deletions(-)
> 
> diff --git a/drivers/input/mouse/psmouse-smbus.c b/drivers/input/mouse/psmouse-smbus.c
> index d0cf2fde173e..c7ac24d119c1 100644
> --- a/drivers/input/mouse/psmouse-smbus.c
> +++ b/drivers/input/mouse/psmouse-smbus.c
> @@ -61,24 +61,29 @@ static void psmouse_smbus_check_adapter(struct i2c_adapter *adapter)
>  
>  static void psmouse_smbus_detach_i2c_client(struct i2c_client *client)
>  {
> -	struct psmouse_smbus_dev *smbdev;
> +	struct psmouse_smbus_dev *smbdev, *tmp;
>  
>  	mutex_lock(&psmouse_smbus_mutex);
>  
> -	list_for_each_entry(smbdev, &psmouse_smbus_list, node) {
> -		if (smbdev->client == client) {
> +	list_for_each_entry_safe(smbdev, tmp, &psmouse_smbus_list, node) {
> +		if (smbdev->client != client)
> +			continue;
> +
> +		kfree(client->dev.platform_data);
> +		client->dev.platform_data = NULL;
> +
> +		if (!smbdev->dead) {
>  			psmouse_dbg(smbdev->psmouse,
>  				    "Marking SMBus companion %s as gone\n",
>  				    dev_name(&smbdev->client->dev));
> -			smbdev->client = NULL;
>  			smbdev->dead = true;
>  			serio_rescan(smbdev->psmouse->ps2dev.serio);
> +		} else {
> +			list_del(&smbdev->node);
> +			kfree(smbdev);
>  		}
>  	}
>  
> -	kfree(client->dev.platform_data);
> -	client->dev.platform_data = NULL;
> -
>  	mutex_unlock(&psmouse_smbus_mutex);
>  }
>  
> @@ -162,17 +167,20 @@ static void psmouse_smbus_disconnect(struct psmouse *psmouse)
>  	struct psmouse_smbus_dev *smbdev = psmouse->private;
>  
>  	mutex_lock(&psmouse_smbus_mutex);
> -	list_del(&smbdev->node);
> -	mutex_unlock(&psmouse_smbus_mutex);
>  
> -	if (smbdev->client) {
> +	if (smbdev->dead) {
> +		list_del(&smbdev->node);
> +		kfree(smbdev);
> +	} else {
> +		smbdev->dead = true;
>  		psmouse_dbg(smbdev->psmouse,
>  			    "posting removal request for SMBus companion %s\n",
>  			    dev_name(&smbdev->client->dev));
>  		psmouse_smbus_schedule_remove(smbdev->client);
>  	}
>  
> -	kfree(smbdev);
> +	mutex_unlock(&psmouse_smbus_mutex);
> +
>  	psmouse->private = NULL;
>  }
>  
> -- 
> 2.12.2.564.g063fe858b8-goog
> 
> 
> -- 
> Dmitry