linux-kernel - Re: [PATCH] Input: synaptics - fix crash when enabling pass-through port

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z48vvnjs3qtoPqqY@google.com>
Date: Mon, 20 Jan 2025 21:25:18 -0800
From: Dmitry Torokhov <dmitry.torokhov@...il.com>
To: Takashi Iwai <tiwai@...e.de>
Cc: linux-input@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] Input: synaptics - fix crash when enabling pass-through
 port

On Sat, Jan 18, 2025 at 10:33:44AM +0100, Takashi Iwai wrote:
> On Sat, 18 Jan 2025 09:46:29 +0100,
> Takashi Iwai wrote:
> > 
> > On Fri, 17 Jan 2025 18:23:40 +0100,
> > Dmitry Torokhov wrote:
> > > 
> > > When enabling a pass-through port an interrupt might come before psmouse
> > > driver binds to the pass-through port. However synaptics sub-driver
> > > tries to access psmouse instance presumably associated with the
> > > pass-through port to figure out if only 1 byte of response or entire
> > > protocol packet needs to be forwarded to the pass-through port and may
> > > crash if psmouse instance has not been attached to the port yet.
> > > 
> > > Fix the crash by introducing open() and close() methods for the port and
> > > check if the port is open before trying to access psmouse instance.
> > > Because psmouse calls serio_open() only after attaching psmouse instance
> > > to serio port instance this prevents the potential crash.
> > > 
> > > Reported-by: Takashi Iwai <tiwai@...e.de>
> > > Fixes: 100e16959c3c ("Input: libps2 - attach ps2dev instances as serio port's drvdata")
> > > Link: https://bugzilla.suse.com/show_bug.cgi?id=1219522
> > > Cc: stable@...r.kernel.org
> > > Signed-off-by: Dmitry Torokhov <dmitry.torokhov@...il.com>
> > 
> > Reviewed-by: Takashi Iwai <tiwai@...e.de>

Thank you for the review.

> 
> BTW, backporting this patch to stable kernels wouldn't be trivial; it
> needs the recent changes for guard(), too.

It is as simple as changing it to pairs of
serio_pause_rx()/serio_continue_rx() so pretty trivial.

Thanks.

-- 
Dmitry