linux-kernel - [PATCH v2] HID: pidff: Fix condition effect bit clearing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260204133138.475880-1-tomasz.pakula.oficjalny@gmail.com>
Date: Wed,  4 Feb 2026 14:31:38 +0100
From: Tomasz Pakuła <tomasz.pakula.oficjalny@...il.com>
To: jikos@...nel.org,
	bentiss@...nel.org
Cc: oleg@...arenk.ooo,
	linux-input@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	tomasz.pakula.oficjalny@...il.com
Subject: [PATCH v2] HID: pidff: Fix condition effect bit clearing

As reported by MPDarkGuy on discord, NULL pointer dereferences were
happening because not all the conditional effects bits were cleared.

Properly clear all conditional effect bits from ffbit

Fixes: 7f3d7bc0df4b ("HID: pidff: Better quirk assigment when searching for fields")
Cc: <stable@...r.kernel.org> # 6.18.x
Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@...il.com>
---
Urgent for 6.19 rc period
V1 -> V2: Simplify by using bitwise or operator

 drivers/hid/usbhid/hid-pidff.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c
index a4e700b40ba9..792992c69837 100644
--- a/drivers/hid/usbhid/hid-pidff.c
+++ b/drivers/hid/usbhid/hid-pidff.c
@@ -1452,9 +1452,10 @@ static int pidff_init_fields(struct pidff_device *pidff, struct input_dev *dev)
 		hid_warn(pidff->hid, "unknown ramp effect layout\n");
 
 	if (PIDFF_FIND_FIELDS(set_condition, PID_SET_CONDITION, 1)) {
-		if (test_and_clear_bit(FF_SPRING, dev->ffbit)   ||
-		    test_and_clear_bit(FF_DAMPER, dev->ffbit)   ||
-		    test_and_clear_bit(FF_FRICTION, dev->ffbit) ||
+		/* Bitwise to ensure all the bits will be cleared */
+		if (test_and_clear_bit(FF_SPRING, dev->ffbit)   |
+		    test_and_clear_bit(FF_DAMPER, dev->ffbit)   |
+		    test_and_clear_bit(FF_FRICTION, dev->ffbit) |
 		    test_and_clear_bit(FF_INERTIA, dev->ffbit))
 			hid_warn(pidff->hid, "unknown condition effect layout\n");
 	}
-- 
2.52.0