linux-kernel - [PATCH] HID: amd_sfh: Check that sensors are enabled before set/get report

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date:   Tue, 20 Jun 2023 15:01:17 -0500
From:   Mario Limonciello <mario.limonciello@....com>
To:     Basavaraj Natikar <basavaraj.natikar@....com>,
        Benjamin Tissoires <benjamin.tissoires@...hat.com>
CC:     Bagas Sanjaya <bagasdotme@...il.com>,
        Malte Starostik <malte@...rostik.de>,
        <linux-input@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        Mario Limonciello <mario.limonciello@....com>,
        <stable@...r.kernel.org>,
        "Linux regression tracking" <regressions@...mhuis.info>,
        Haochen Tong <linux@...chain.org>
Subject: [PATCH] HID: amd_sfh: Check that sensors are enabled before set/get report

A crash was reported in amd-sfh related to hid core initialization
before SFH initialization has run.

```
   amdtp_hid_request+0x36/0x50 [amd_sfh
2e3095779aada9fdb1764f08ca578ccb14e41fe4]
   sensor_hub_get_feature+0xad/0x170 [hid_sensor_hub
d6157999c9d260a1bfa6f27d4a0dc2c3e2c5654e]
   hid_sensor_parse_common_attributes+0x217/0x310 [hid_sensor_iio_common
07a7935272aa9c7a28193b574580b3e953a64ec4]
   hid_gyro_3d_probe+0x7f/0x2e0 [hid_sensor_gyro_3d
9f2eb51294a1f0c0315b365f335617cbaef01eab]
   platform_probe+0x44/0xa0
   really_probe+0x19e/0x3e0
```

Ensure that sensors have been set up before calling into
amd_sfh_get_report() or amd_sfh_set_report().

Cc: stable@...r.kernel.org
Cc: Linux regression tracking (Thorsten Leemhuis) <regressions@...mhuis.info>
Fixes: 7bcfdab3f0c6 ("HID: amd_sfh: if no sensors are enabled, clean up")
Reported-by: Haochen Tong <linux@...chain.org>
Link: https://lore.kernel.org/all/3250319.ancTxkQ2z5@zen/T/
Signed-off-by: Mario Limonciello <mario.limonciello@....com>
---
 drivers/hid/amd-sfh-hid/amd_sfh_client.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_client.c b/drivers/hid/amd-sfh-hid/amd_sfh_client.c
index d9b7b01900b5..88f3d913eaa1 100644
--- a/drivers/hid/amd-sfh-hid/amd_sfh_client.c
+++ b/drivers/hid/amd-sfh-hid/amd_sfh_client.c
@@ -25,6 +25,9 @@ void amd_sfh_set_report(struct hid_device *hid, int report_id,
 	struct amdtp_cl_data *cli_data = hid_data->cli_data;
 	int i;
 
+	if (!cli_data->is_any_sensor_enabled)
+		return;
+
 	for (i = 0; i < cli_data->num_hid_devices; i++) {
 		if (cli_data->hid_sensor_hubs[i] == hid) {
 			cli_data->cur_hid_dev = i;
@@ -41,6 +44,9 @@ int amd_sfh_get_report(struct hid_device *hid, int report_id, int report_type)
 	struct request_list *req_list = &cli_data->req_list;
 	int i;
 
+	if (!cli_data->is_any_sensor_enabled)
+		return -ENODEV;
+
 	for (i = 0; i < cli_data->num_hid_devices; i++) {
 		if (cli_data->hid_sensor_hubs[i] == hid) {
 			struct request_list *new = kzalloc(sizeof(*new), GFP_KERNEL);
-- 
2.34.1