Re: [PATCH v6] HID: pulsar: add driver for Pulsar gaming mice
Nikolas Koesling <[email protected]>
| Newsgroups | dev.linux.lists.sashiko-reviews,org.kernel.vger.linux-input |
|---|---|
| Message-ID | <[email protected]> |
> - [Critical] The `drvdata` structure is freed before the battery power supply is unregistered, leading to a Use-After-Free vulnerability if userspace reads battery properties during device removal. `devres_release_all` releases all nodes in LIFO order. `devm_kzalloc` and `devm_power_supply_register` are called on the same device, so the power supply is unregistered first. > - [Medium] The fallback logic for non-Pulsar devices during battery initialization is bypassed on command timeout. The dongle answers commands even while the mouse is off. So if the command times out there is a protocol missmatch or the device is malfunctioning. Not registering a battery in this case is the right behaviour. > - [Low] Syntax error in the `model` buffer size will prevent compilation. It compiles with gcc 16.1.1.