HID: steam: fixes race in handling device list. (2d3f53a8) · Commits · 戴 / test

Using uhid and KASAN this driver crashed because it was getting several connection events where it only expected one. Then the device was added several times to the static device list and it got corrupted. This patch checks if the device is already in the list before adding it. Signed-off-by:

Rodrigo Rivas Costa <rodrigorivascosta@gmail.com> Tested-by:

Siarhei Vishniakou <svv@google.com> Signed-off-by:

Jiri Kosina <jkosina@suse.cz>

drivers/hid/hid-steam.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -526,6 +526,7 @@ static int steam_register(struct steam_device *steam)
		steam_battery_register(steam);

		mutex_lock(&steam_devices_lock);
		if (list_empty(&steam->list))
		list_add(&steam->list, &steam_devices);
		mutex_unlock(&steam_devices_lock);
		}
		@@ -552,7 +553,7 @@ static void steam_unregister(struct steam_device *steam)
		hid_info(steam->hdev, "Steam Controller '%s' disconnected",
		steam->serial_no);
		mutex_lock(&steam_devices_lock);
		list_del(&steam->list);
		list_del_init(&steam->list);
		mutex_unlock(&steam_devices_lock);
		steam->serial_no[0] = 0;
		}
		@@ -738,6 +739,7 @@ static int steam_probe(struct hid_device *hdev,
		mutex_init(&steam->mutex);
		steam->quirks = id->driver_data;
		INIT_WORK(&steam->work_connect, steam_work_connect_cb);
		INIT_LIST_HEAD(&steam->list);

		steam->client_hdev = steam_create_client_hid(hdev);
		if (IS_ERR(steam->client_hdev)) {

Admin message