linux-kernel - Re: [PATCH] Input: cyapa - fix missing input->mutex when calling input_device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aYHEzf5nYpA1H5Cj@google.com>
Date: Tue, 3 Feb 2026 01:52:24 -0800
From: Dmitry Torokhov <dmitry.torokhov@...il.com>
To: Ziyi Guo <n7l8m4@...orthwestern.edu>
Cc: linux-input@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] Input: cyapa - fix missing input->mutex when calling
 input_device_enabled()

Hi Ziyi,

On Mon, Feb 02, 2026 at 10:02:23PM +0000, Ziyi Guo wrote:
> cyapa_enable_irq_for_cmd()/cyapa_disable_irq_for_cmd() and
> cyapa_reinitialize call input_device_enabled() without holding
> input->mutex. However, input_device_enabled() has
> lockdep_assert_held(&dev->mutex).
> 
> Add mutex_lock()/mutex_unlock() around the input_device_enabled()
> call to properly protect access to the input device state.
> 
> Signed-off-by: Ziyi Guo <n7l8m4@...orthwestern.edu>
> ---
>  drivers/input/mouse/cyapa.c | 27 ++++++++++++++++++++++++---
>  1 file changed, 24 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/input/mouse/cyapa.c b/drivers/input/mouse/cyapa.c
> index 00c87c0532a6..e5fe3b8b6548 100644
> --- a/drivers/input/mouse/cyapa.c
> +++ b/drivers/input/mouse/cyapa.c
> @@ -525,8 +525,15 @@ static int cyapa_create_input_dev(struct cyapa *cyapa)
>  static void cyapa_enable_irq_for_cmd(struct cyapa *cyapa)
>  {
>  	struct input_dev *input = cyapa->input;
> +	bool input_enabled = false;
>  
> -	if (!input || !input_device_enabled(input)) {
> +	if (input) {
> +		mutex_lock(&input->mutex);
> +		input_enabled = input_device_enabled(input);
> +		mutex_unlock(&input->mutex);

This solves absolutely nothing. The value of input_enabled becomes stale
the very moment you release the mutex.

The driver requires much more through conversion to handle potential
races with opening and closing the input device.

Thanks.

-- 
Dmitry