Subject: [PATCH] HID: hidraw: fix data race on device refcount

From: Ludvig Michaelsson <[email protected]>

The hidraw_open() function increments the hidraw device reference
counter. The counter has no dedicated synchronization mechanism,
resulting in a potential data race when concurrently opening a device.

The race is a regression introduced by commit 8590222e4b02 ("HID:
hidraw: Replace hidraw device table mutex with a rwsem"). While
minors_rwsem is intended to protect the hidraw_table itself, by instead
acquiring the lock for writing, the reference counter is also protected.
This is symmetrical to hidraw_release().

Link: https://github.com/systemd/systemd/issues/27947
Fixes: 8590222e4b02 ("HID: hidraw: Replace hidraw device table mutex with a rwsem")
Signed-off-by: Ludvig Michaelsson <[email protected]>
---
drivers/hid/hidraw.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index 93e62b161501..e63c56a0d57f 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -272,7 +272,12 @@ static int hidraw_open(struct inode *inode, struct file *file)
goto out;
}

- down_read(&minors_rwsem);
+ /*
+ * Technically not writing to the hidraw_table but a write lock is
+ * required to protect the device refcount. This is symmetrical to
+ * hidraw_release().
+ */
+ down_write(&minors_rwsem);
if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
err = -ENODEV;
goto out_unlock;
@@ -301,7 +306,7 @@ static int hidraw_open(struct inode *inode, struct file *file)
spin_unlock_irqrestore(&hidraw_table[minor]->list_lock, flags);
file->private_data = list;
out_unlock:
- up_read(&minors_rwsem);
+ up_write(&minors_rwsem);
out:
if (err < 0)
kfree(list);

---
base-commit: 45a3e24f65e90a047bef86f927ebdc4c710edaa1
change-id: 20230621-hidraw-race-b51b11bf11ed

Best regards,
--
Ludvig Michaelsson <[email protected]>



2023-06-21 16:17:21

by Benjamin Tissoires

[permalink] [raw]
Subject: Re: [PATCH] HID: hidraw: fix data race on device refcount

On Wed, 21 Jun 2023 13:17:43 +0200, Ludvig Michaelsson wrote:
> The hidraw_open() function increments the hidraw device reference
> counter. The counter has no dedicated synchronization mechanism,
> resulting in a potential data race when concurrently opening a device.
>
> The race is a regression introduced by commit 8590222e4b02 ("HID:
> hidraw: Replace hidraw device table mutex with a rwsem"). While
> minors_rwsem is intended to protect the hidraw_table itself, by instead
> acquiring the lock for writing, the reference counter is also protected.
> This is symmetrical to hidraw_release().
>
> [...]

Added stable@ cc tags and

Applied to hid/hid.git (for-6.4/upstream-fixes), thanks!

[1/1] HID: hidraw: fix data race on device refcount
https://git.kernel.org/hid/hid/c/944ee77dc6ec

Cheers,
--
Benjamin Tissoires <[email protected]>