From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ua1-f43.google.com (mail-ua1-f43.google.com [209.85.222.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DEC8946AF02 for ; Tue, 14 Jul 2026 13:39:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=209.85.222.43 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784036364; cv=pass; b=EIyHggQlTrJl0wSnxEvaXCa31LWjjt1SY0yOq2hJRbCQBQ1sTfov7m0OX8MF2Bmnv8i4Z2cbn/6q6SNT9TFdosUK+nW/dwGcfz2K9W7MDqaam84X6TqNdstILFmNaQ8OC73yez9f20icMmSW4kYeP0iQ00OyCLwWtInqaQ5Ve+8= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784036364; c=relaxed/simple; bh=DwIb33/MUbNJ6SXd61hMtjAJP3vWKRsR+k6fH0eQFvQ=; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=hTI2Ban5V3N4pGKhq8AjrcffniJ090T0+QBrdYrGLI7QQajAltglqPnOGC+5I6isrt0Zsr+fXT86En3AltnrNprTjS69oTInVx2jwJlpvPPI7rTeAa6yJ/KxfnQaH1IZoox03awgmma0nkHF6M8CeXT9hA+DUSE1fQjoeKCmSv8= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=IGR9jPXe; arc=pass smtp.client-ip=209.85.222.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="IGR9jPXe" Received: by mail-ua1-f43.google.com with SMTP id a1e0cc1a2514c-96710629eb1so416928241.2 for ; Tue, 14 Jul 2026 06:39:22 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1784036362; cv=none; d=google.com; s=arc-20260327; b=apMH06+eqAiPJl9cx5hnhSO4rY9llP/uJV5kxE/pIqYHlM3PqBRbd9ESVo1jWhCRni x0Ibgy+Xt73/Kh9li3n0JXJ7FEFPfI6Lm/WgCB49OGml9Li9E/VEFeUJIlKQmdX65tuF ehwC9g5jAuRxnhrWHAbjP5jNJ74SJPURaxxKF5tiPDbG2SDM24CARpeD0Ruwwel+y/hV mmEeTPn7I9JIIO0h5Pgp4fQBUvA44pk1I9+3ZeebnMOp6WK/n+c4/ctkXLXwDe//pE1I umwNlAEnZxPVAIbZfQCQvtc3RLyNhyDrFHb7zwvJpAL8LQbfsZSuV3BCITqVP/qsl/Il ilag== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=DwIb33/MUbNJ6SXd61hMtjAJP3vWKRsR+k6fH0eQFvQ=; fh=oAxzLB91BGik/6/HdZSjuQbVgO1/eifFk4fp82b2sRw=; b=Mh4wGk7aPu4rbRxdDa0YGtdPgj1us12SAAEpLvrY4DrR3jBU7AA0u+WfUnddyYN2Zb e/98pBhXxs6asxWhiE9fjEdwa2TK1tXAIlXMiguUJhNZIUpYIl1HD5ky12VM6ewO88jF 7NESbvjaGma7PoNQXU7tXneEsePLz5Gzwxg5lrjpqsdSWkTjCqkhAvRnH6NyaJfWlkiX G207JG/KFCZgI+DPxp5yCqhL1n6K+UoQm/ufJTg3+gFw721eN1sWbRe5dVZk0dHoF0tT 5sKA69MkZIFFMk2Y8ZaIO9Z8IYg/ryGiq/O6DPBZba0s1cenoU1alhCHCjbcj1OH34Xo 3fMw==; darn=vger.kernel.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784036362; x=1784641162; darn=vger.kernel.org; h=content-transfer-encoding:content-type:cc:to:subject:message-id :date:from:in-reply-to:references:mime-version:from:to:cc:subject :date:message-id:reply-to:content-type; bh=DwIb33/MUbNJ6SXd61hMtjAJP3vWKRsR+k6fH0eQFvQ=; b=IGR9jPXeH7pCwyfO7LdiKzeEuf8W+oMvXZk2HXESeHtVEuExM6/j9Gl0m6I+EuL3pC QwOq8L0hmEIci0TnHs281UpxWabzMjA8pUAcAwe6kNjXVUoE2DvAAZO2CS6s8rg9GQR1 xadRMvd3OjXz7FxDs56sQby3IoZMros7KFu2v91DiFhiaXFxmEO8UAa0sMht4obGBacD SEXkUTU5/BrVJ863yRqbFhLUzloh/gFsbHYvSffErCKEUfWzWcVcex6JaD0uHlxkVOGM 8Q//Okk/glh+Vq+iDqFikibHop7MpJwaXkNFdm86yqcxqDPGTe8SpdIHQAh9T+IQenNn tFlA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784036362; x=1784641162; h=content-transfer-encoding:content-type:cc:to:subject:message-id :date:from:in-reply-to:references:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=DwIb33/MUbNJ6SXd61hMtjAJP3vWKRsR+k6fH0eQFvQ=; b=XwsK938CSEJ5OD5WFyPB88idLHDOE5JdOmEO/Y+s1gpz7DIwA5DytftquiK6InpSsF DU/ybxv9s7mQF2UY+oNc3VNexTSdNvAMgZjjmif5EsNa/ZENThu1KGpXMzJoTzeCPqVu K+IikQMP0LZl5bghLkBT75b4LILQTQkuuPCBBHu57da27ft5XlatQB/pEWg5H1pGfZCr dAJWoJD1kZd0XSkS91Kk1pa/KL43KrpQYJ14EZWbOG+dDop2eJI4O0LoLbrtEKb9hBMe QWIl4L/0TL7rpFOZ9ipqd+xJloojQbUxoGPVsnUEoPqEYObt8VLZG/8ytsI1zF5SjmVq fT1A== X-Forwarded-Encrypted: i=1; AHgh+Rqhqyn4yAGHiG/FLANTh6cjbpSr0z07PGeh15VIJ4KwZIw244EYEfA6ytSEokSLzh31pcpso+PFU9RD0A8=@vger.kernel.org X-Gm-Message-State: AOJu0Yyo3nQu8VjVXtJfiBAddTubTWKcBErAUWbgttZx2CLQLOAAJfyT 26RLLYmvE4nLHFmcoATy1l6emevfhGD2/0lej1B8v+AzOWolGqlmffoQXzCw87/Cpdru+wzk5+r 8ZiuSm2Dd+J9TDbxqIgjwKcEYa/z9bfA= X-Gm-Gg: AfdE7ckb6NzonUBVA8AmL6y5JofKd7uoh4Qd6dmTyTnkf2joerP9b5RU7nMD/j9gzLL oGzEGZhHPJx03kJPfdjuZWEa5jyaAhPckhkY0AYv1snNt/jDzr3P88qshKgVxUHAkKL9C30L5WB 2e85r0K7v+Ynlq86LMyrR3CLNg3Iw1kxJcEkGrsljBK8hX6MHlT/Y9Rm4/+5DtBDfcEL3Rb1fWw XHEMwu4AvrHk6TYEPh3vYYJ6JGTRJoqCoufv7hcc8iGyvrMfv2iCp3OM0ZQc5MAv2jPBBR8eaU= X-Received: by 2002:a05:6102:441d:b0:643:80f1:350a with SMTP id ada2fe7eead31-74533b42f88mr8627150137.2.1784036361731; Tue, 14 Jul 2026 06:39:21 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 References: <20260714120052.255085-1-chlgustn3171@gmail.com> <20260714121819.5FCC91F00A3A@smtp.kernel.org> In-Reply-To: From: chlgustn3171 Date: Tue, 14 Jul 2026 22:39:09 +0900 X-Gm-Features: AUfX_myYjaJA6AxmS1f1aMv-_YdelHEt1X3VS9D4jvlYoByEOFtdLcCWT5iVDmo Message-ID: Subject: Re: [PATCH] HID: input: allocate input_dev name/phys/uniq using hid device devres To: sashiko-reviews@lists.linux.dev Cc: linux-input@vger.kernel.org, dmitry.torokhov@gmail.com, Jiri Kosina , Benjamin Tissoires , linux-kernel@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Adding maintainers and mailing list to CC. Sorry for the omission. On Tue, Jul 14, 2026 at 10:33=E2=80=AFPM chlgustn3171 wrote: > > On Tue, Jul 14, 2026 at 9:18=E2=80=AFPM sashiko-bot wrote: > > [Severity: High] > > If a userspace process holds an open file descriptor for the evdev node > > (/dev/input/eventX), the input_dev will outlive the parent hid->dev. > > When the HID device is unbound, devres will free these strings. > > > > Can this cause a use-after-free when userspace later queries the > > name, phys, or uniq strings via ioctl (e.g., EVIOCGNAME)? > > Thanks for the review. > > Using &hid->dev here is intentional. > Using the input device for devm-managed input_dev strings is > problematic; see CVE-2023-53454, where the allocation was moved to the > HID device because the input device unregister path may still use the > name for uevents. > > > [Severity: Low] > > If devm_kstrdup() fails for phys or uniq, the code jumps here to the > > error path. The earlier successful devm_kstrdup() allocations remain > > tied to &hid->dev. > > > > If the caller continues the device probe successfully after this failur= e, > > will these strings be leaked for the lifetime of the HID device? > > The name/phys/uniq copies are attached to &hid->dev, so the clean-up > is handled by HID device devres. > However, if it is better to explicitly unwind, I can add that in v2. > > Thanks, > Hyeonsu