[PATCH 00/21] HID: fix racy force feedback initialization via .input_configured()
Dmitry Torokhov <[email protected]>
| Newsgroups | org.kernel.vger.linux-kernel,org.kernel.vger.linux-doc,org.kernel.vger.linux-input |
|---|---|
| Message-ID | <[email protected]> |
When a HID driver calls hid_hw_start() with the HID_CONNECT_HIDINPUT flag (included in HID_CONNECT_DEFAULT), the HID core immediately registers the input device with the input subsystem, making it live and accessible to userspace. Historically, many HID drivers initialized force-feedback capabilities (via input_ff_create_memless() or custom workqueues) in their probe() callback after calling hid_hw_start(). This introduces a window where userspace can open the input node and trigger force-feedback ioctls before the driver has finished preparing its private structures or workqueues, leading to potential NULL pointer dereferences and race conditions. To eliminate this anti-pattern across the subsystem, this series: - Enhances the HID core to automatically handle driver force-feedback initialization during input device registration. - Refactors individual HID drivers to perform all force-feedback setup inside the .input_configured() callback, ensuring the input device is fully prepared before it is exposed to userspace. - Adds documentation and a Coccinelle script to prevent future regressions. Signed-off-by: Dmitry Torokhov <[email protected]> --- Dmitry Torokhov (21): HID: core: automatically initialize generic FF if no other FF is present HID: add documentation and Coccinelle script for FF registration race HID: axff: move FF initialization to .input_configured() HID: betop: move FF initialization to .input_configured() HID: bigben: move FF initialization to .input_configured() HID: dragonrise: move FF initialization to .input_configured() HID: emsff: move FF initialization to .input_configured() HID: gaff: move FF initialization to .input_configured() HID: stadia: use open/close to manage workqueue lifecycle HID: stadia: move FF initialization to .input_configured() HID: holtek: move FF initialization to .input_configured() HID: move generic FF initialization into hidinput_connect() HID: microsoft: move FF initialization to .input_configured() HID: pantherlord: move FF initialization to .input_configured() HID: thrustmaster: move FF initialization to .input_configured() HID: zeroplus: move FF initialization to .input_configured() HID: mayflash: move FF initialization to .input_configured() HID: smartjoyplus: move FF initialization to .input_configured() HID: megaworld: move FF initialization to .input_configured() HID: logitech-hidpp: move FF initialization to .input_configured() HID: haptic: move FF initialization into .input_configured() Documentation/hid/hidintro.rst | 50 ++++++++++++ drivers/hid/hid-axff.c | 40 +++------- drivers/hid/hid-betopff.c | 33 +++----- drivers/hid/hid-bigbenff.c | 89 ++++++++++----------- drivers/hid/hid-core.c | 8 +- drivers/hid/hid-dr.c | 66 ++++----------- drivers/hid/hid-emsff.c | 50 ++---------- drivers/hid/hid-gaff.c | 53 +++---------- drivers/hid/hid-google-stadiaff.c | 112 ++++++++++---------------- drivers/hid/hid-haptic.c | 45 ++++------- drivers/hid/hid-haptic.h | 6 +- drivers/hid/hid-holtekff.c | 46 +++-------- drivers/hid/hid-input.c | 21 ++++- drivers/hid/hid-logitech-hidpp.c | 36 +++++---- drivers/hid/hid-megaworld.c | 51 +++--------- drivers/hid/hid-mf.c | 77 +++++++----------- drivers/hid/hid-microsoft.c | 38 ++------- drivers/hid/hid-multitouch.c | 10 +-- drivers/hid/hid-pl.c | 150 +++++++++++++++-------------------- drivers/hid/hid-sjoy.c | 83 ++++++++----------- drivers/hid/hid-tmff.c | 47 ++++------- drivers/hid/hid-zpff.c | 43 ++-------- include/linux/hid.h | 2 +- scripts/coccinelle/hid/ff_race.cocci | 34 ++++++++ 24 files changed, 465 insertions(+), 725 deletions(-) --- base-commit: 415606a7be939835db9b0d6b711887586646346d change-id: 20260802-hid-ff-input-configured-397bc1503256 Thanks. -- Dmitry