kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
linux/drivers/macintosh
History
Long Li 48a7d427eb macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse 
[ Upstream commit 1e4b207ffe ]

The following warning appears when running syzkaller, and this issue also
exists in the mainline code.

 ------------[ cut here ]------------
 list_add double add: new=ffffffffa57eee28, prev=ffffffffa57eee28, next=ffffffffa5e63100.
 WARNING: CPU: 0 PID: 1491 at lib/list_debug.c:35 __list_add_valid_or_report+0xf7/0x130
 Modules linked in:
 CPU: 0 PID: 1491 Comm: syz.1.28 Not tainted 6.6.0+ #3
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
 RIP: 0010:__list_add_valid_or_report+0xf7/0x130
 RSP: 0018:ff1100010dfb7b78 EFLAGS: 00010282
 RAX: 0000000000000000 RBX: ffffffffa57eee18 RCX: ffffffff97fc9817
 RDX: 0000000000040000 RSI: ffa0000002383000 RDI: 0000000000000001
 RBP: ffffffffa57eee28 R08: 0000000000000001 R09: ffe21c0021bf6f2c
 R10: 0000000000000001 R11: 6464615f7473696c R12: ffffffffa5e63100
 R13: ffffffffa57eee28 R14: ffffffffa57eee28 R15: ff1100010dfb7d48
 FS:  00007fb14398b640(0000) GS:ff11000119600000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 0000000000000000 CR3: 000000010d096005 CR4: 0000000000773ef0
 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
 PKRU: 80000000
 Call Trace:
  <TASK>
  input_register_handler+0xb3/0x210
  mac_hid_start_emulation+0x1c5/0x290
  mac_hid_toggle_emumouse+0x20a/0x240
  proc_sys_call_handler+0x4c2/0x6e0
  new_sync_write+0x1b1/0x2d0
  vfs_write+0x709/0x950
  ksys_write+0x12a/0x250
  do_syscall_64+0x5a/0x110
  entry_SYSCALL_64_after_hwframe+0x78/0xe2

The WARNING occurs when two processes concurrently write to the mac-hid
emulation sysctl, causing a race condition in mac_hid_toggle_emumouse().
Both processes read old_val=0, then both try to register the input handler,
leading to a double list_add of the same handler.

  CPU0                             CPU1
  -------------------------        -------------------------
  vfs_write() //write 1            vfs_write()  //write 1
    proc_sys_write()                 proc_sys_write()
      mac_hid_toggle_emumouse()          mac_hid_toggle_emumouse()
        old_val = *valp // old_val=0
                                           old_val = *valp // old_val=0
                                           mutex_lock_killable()
                                           proc_dointvec() // *valp=1
                                           mac_hid_start_emulation()
                                             input_register_handler()
                                           mutex_unlock()
        mutex_lock_killable()
        proc_dointvec()
        mac_hid_start_emulation()
          input_register_handler() //Trigger Warning
        mutex_unlock()

Fix this by moving the old_val read inside the mutex lock region.

Fixes: 99b089c3c3 ("Input: Mac button emulation - implement as an input filter")
Signed-off-by: Long Li <leo.lilong@huawei.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20250819091035.2263329-1-leo.lilong@huaweicloud.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-12-18 14:02:55 +01:00
..
ams macintosh: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-06-28 22:08:05 +10:00
adb-iop.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
adb.c [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
adbhid.c treewide: Switch/rename to timer_delete[_sync]() 2025-04-05 10:30:12 +02:00
ans-lcd.c macintosh: Prepare cleanup of powerpc's asm/prom.h 2022-05-11 23:06:39 +10:00
ans-lcd.h misc: cleanup minor number definitions in c file into miscdevice.h 2020-03-18 12:27:03 +01:00
apm_emu.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 118 2019-05-24 17:39:02 +02:00
Kconfig fbdev: Fix recursive dependencies wrt BACKLIGHT_CLASS_DEVICE 2024-12-17 18:06:10 +01:00
mac_hid.c macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse 2025-12-18 14:02:55 +01:00
macio-adb.c macintosh/macio-adb: replace of_node_put() with __free 2024-04-30 21:53:13 +10:00
macio_asic.c dma-mapping: clearly mark DMA ops as an architecture feature 2024-09-04 07:08:51 +03:00
macio_sysfs.c macintosh: Prepare cleanup of powerpc's asm/prom.h 2022-05-11 23:06:39 +10:00
Makefile macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled 2022-05-22 15:58:30 +10:00
mediabay.c macintosh: Prepare cleanup of powerpc's asm/prom.h 2022-05-11 23:06:39 +10:00
rack-meter.c powerpc/macio: Make remove callback of macio driver void returned 2024-03-07 23:06:19 +11:00
smu.c mm/memblock: add memblock_alloc_or_panic interface 2025-01-25 20:22:38 -08:00
therm_adt746x.c macintosh: Explicitly include correct DT includes 2023-08-28 13:36:24 -05:00
therm_windtunnel.c Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
via-cuda.c macintosh: Use of_address_to_resource() 2023-06-21 14:08:54 +10:00
via-macii.c macintosh/via-macii: Fix "BUG: sleeping function called from invalid context" 2024-04-29 16:45:53 +02:00
via-pmu-backlight.c macintosh/via-pmu-backlight: Use backlight power constants 2024-08-07 22:48:26 +10:00
via-pmu-event.c Input: via-pmu - add input device support 2006-06-26 01:49:55 -04:00
via-pmu-event.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
via-pmu-led.c macintosh: Use common error handling code in via_pmu_led_init() 2024-11-14 22:54:28 +11:00
via-pmu.c macintosh/via-pmu: register_pmu_pm_ops() can be __init 2024-09-05 22:30:18 +10:00
windfarm.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 246 2019-06-19 17:09:08 +02:00
windfarm_ad7417_sensor.c macintosh: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-06-28 22:08:05 +10:00
windfarm_core.c macintosh: Prepare cleanup of powerpc's asm/prom.h 2022-05-11 23:06:39 +10:00
windfarm_cpufreq_clamp.c macintosh: Prepare cleanup of powerpc's asm/prom.h 2022-05-11 23:06:39 +10:00
windfarm_fcu_controls.c macintosh: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-06-28 22:08:05 +10:00
windfarm_lm75_sensor.c macintosh: Explicitly include correct DT includes 2023-08-28 13:36:24 -05:00
windfarm_lm87_sensor.c macintosh: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-06-28 22:08:05 +10:00
windfarm_max6690_sensor.c macintosh: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-06-28 22:08:05 +10:00
windfarm_mpu.h macintosh: Prepare cleanup of powerpc's asm/prom.h 2022-05-11 23:06:39 +10:00
windfarm_pid.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 246 2019-06-19 17:09:08 +02:00
windfarm_pid.h macintosh/windfarm_pid: Add header file macro definition 2022-11-24 23:12:18 +11:00
windfarm_pm72.c Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
windfarm_pm81.c Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
windfarm_pm91.c Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
windfarm_pm112.c Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
windfarm_pm121.c Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
windfarm_rm31.c Get rid of 'remove_new' relic from platform driver struct 2024-12-01 15:12:43 -08:00
windfarm_smu_controls.c macintosh: Switch to use for_each_child_of_node() macro 2022-11-24 23:12:18 +11:00
windfarm_smu_sat.c macintosh: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-06-28 22:08:05 +10:00
windfarm_smu_sensors.c macintosh: windfarm: Use unsigned type for 1-bit bitfields 2023-02-16 10:16:31 +11:00