diff options
| author | Christian Brauner <brauner@kernel.org> | 2025-09-17 12:01:05 +0200 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2025-09-19 14:26:14 +0200 |
| commit | 7914f15c5e45ea6c76f2b3272ff39d8fe67b13f5 (patch) | |
| tree | 32385a82110d012928536d7787b024add8818f63 /drivers/hid/hid-asus.c | |
| parent | 885fc8ac0a4dc70f5d87b80b0977292870e35c60 (diff) | |
| parent | 38f4885088fc5ad41b8b0a2a2cfc73d01e709e5c (diff) | |
Merge branch 'no-rebase-mnt_ns_tree_remove'
Bring in the fix for removing a mount namespace from the mount namespace
rbtree and list.
Signed-off-by: Christian Brauner <brauner@kernel.org>
Diffstat (limited to 'drivers/hid/hid-asus.c')
| -rw-r--r-- | drivers/hid/hid-asus.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c index 4b45e31f0bab..d27dcfb2b9e4 100644 --- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -1213,7 +1213,13 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id) return ret; } - if (!drvdata->input) { + /* + * Check that input registration succeeded. Checking that + * HID_CLAIMED_INPUT is set prevents a UAF when all input devices + * were freed during registration due to no usages being mapped, + * leaving drvdata->input pointing to freed memory. + */ + if (!drvdata->input || !(hdev->claimed & HID_CLAIMED_INPUT)) { hid_err(hdev, "Asus input not registered\n"); ret = -ENOMEM; goto err_stop_hw; |