linux-kernel - Re: [PATCH] HID: magicmouse: fix NULL-deref on disconnect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <nycvar.YFH.7.76.2105261250560.28378@cbobk.fhfr.pm>
Date:   Wed, 26 May 2021 12:51:03 +0200 (CEST)
From:   Jiri Kosina <jikos@...nel.org>
To:     Johan Hovold <johan@...nel.org>
cc:     Benjamin Tissoires <benjamin.tissoires@...hat.com>,
        linux-input@...r.kernel.org, linux-kernel@...r.kernel.org,
        syzbot+ee6f6e2e68886ca256a8@...kaller.appspotmail.com,
        stable@...r.kernel.org, Claudio Mettler <claudio@...yfleisch.ch>,
        Marek Wyborski <marek.wyborski@...esoft.com>,
        Sean O'Brien <seobrien@...omium.org>
Subject: Re: [PATCH] HID: magicmouse: fix NULL-deref on disconnect

On Mon, 17 May 2021, Johan Hovold wrote:

> Commit 9d7b18668956 ("HID: magicmouse: add support for Apple Magic
> Trackpad 2") added a sanity check for an Apple trackpad but returned
> success instead of -ENODEV when the check failed. This means that the
> remove callback will dereference the never-initialised driver data
> pointer when the driver is later unbound (e.g. on USB disconnect).
> 
> Reported-by: syzbot+ee6f6e2e68886ca256a8@...kaller.appspotmail.com
> Fixes: 9d7b18668956 ("HID: magicmouse: add support for Apple Magic Trackpad 2")
> Cc: stable@...r.kernel.org      # 4.20
> Cc: Claudio Mettler <claudio@...yfleisch.ch>
> Cc: Marek Wyborski <marek.wyborski@...esoft.com>
> Cc: Sean O'Brien <seobrien@...omium.org>
> Signed-off-by: Johan Hovold <johan@...nel.org>

Applied, thanks Johan.

-- 
Jiri Kosina
SUSE Labs