Commit 2d3f53a8 authored by Rodrigo Rivas Costa's avatar Rodrigo Rivas Costa Committed by Jiri Kosina

HID: steam: fixes race in handling device list.

Using uhid and KASAN this driver crashed because it was getting
several connection events where it only expected one. Then the
device was added several times to the static device list and it got
corrupted.

This patch checks if the device is already in the list before adding
it.
Signed-off-by: default avatarRodrigo Rivas Costa <rodrigorivascosta@gmail.com>
Tested-by: default avatarSiarhei Vishniakou <svv@google.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent 6363d206
...@@ -526,6 +526,7 @@ static int steam_register(struct steam_device *steam) ...@@ -526,6 +526,7 @@ static int steam_register(struct steam_device *steam)
steam_battery_register(steam); steam_battery_register(steam);
mutex_lock(&steam_devices_lock); mutex_lock(&steam_devices_lock);
if (list_empty(&steam->list))
list_add(&steam->list, &steam_devices); list_add(&steam->list, &steam_devices);
mutex_unlock(&steam_devices_lock); mutex_unlock(&steam_devices_lock);
} }
...@@ -552,7 +553,7 @@ static void steam_unregister(struct steam_device *steam) ...@@ -552,7 +553,7 @@ static void steam_unregister(struct steam_device *steam)
hid_info(steam->hdev, "Steam Controller '%s' disconnected", hid_info(steam->hdev, "Steam Controller '%s' disconnected",
steam->serial_no); steam->serial_no);
mutex_lock(&steam_devices_lock); mutex_lock(&steam_devices_lock);
list_del(&steam->list); list_del_init(&steam->list);
mutex_unlock(&steam_devices_lock); mutex_unlock(&steam_devices_lock);
steam->serial_no[0] = 0; steam->serial_no[0] = 0;
} }
...@@ -738,6 +739,7 @@ static int steam_probe(struct hid_device *hdev, ...@@ -738,6 +739,7 @@ static int steam_probe(struct hid_device *hdev,
mutex_init(&steam->mutex); mutex_init(&steam->mutex);
steam->quirks = id->driver_data; steam->quirks = id->driver_data;
INIT_WORK(&steam->work_connect, steam_work_connect_cb); INIT_WORK(&steam->work_connect, steam_work_connect_cb);
INIT_LIST_HEAD(&steam->list);
steam->client_hdev = steam_create_client_hid(hdev); steam->client_hdev = steam_create_client_hid(hdev);
if (IS_ERR(steam->client_hdev)) { if (IS_ERR(steam->client_hdev)) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment