tree 4f7c8c140539ad0fb9cb459aaf140cc833a25762
parent dcb71b3f7efdb1b0248533c46045712874b68f99
author Roderick Colenbrander <roderick@gaikai.com> 1564781248 -0700
committer Siarhei Vishniakou <svv@google.com> 1573059664 +0000

UPSTREAM: HID: sony: Fix race condition between rumble and device remove.

Valve reported a kernel crash on Ubuntu 18.04 when disconnecting a DS4
gamepad while rumble is enabled. This issue is reproducible with a
frequency of 1 in 3 times in the game Borderlands 2 when using an
automatic weapon, which triggers many rumble operations.

We found the issue to be a race condition between sony_remove and the
final device destruction by the HID / input system. The problem was
that sony_remove didn't clean some of its work_item state in
"struct sony_sc". After sony_remove work, the corresponding evdev
node was around for sufficient time for applications to still queue
rumble work after "sony_remove".

On pre-4.19 kernels the race condition caused a kernel crash due to a
NULL-pointer dereference as "sc->output_report_dmabuf" got freed during
sony_remove. On newer kernels this crash doesn't happen due the buffer
now being allocated using devm_kzalloc. However we can still queue work,
while the driver is an undefined state.

This patch fixes the described problem, by guarding the work_item
"state_worker" with an initialized variable, which we are setting back
to 0 on cleanup.

Bug: 139372370

Signed-off-by: Roderick Colenbrander <roderick.colenbrander@sony.com>
CC: stable@vger.kernel.org
(cherry picked from commit e0f6974a54d3f7f1b5fdf5a593bd43ce9206ec04
("HID: sony: Fix race condition between rumble and device remove."))
Signed-off-by: Siarhei Vishniakou <svv@google.com>
Change-Id: I08ba1daf2d539f4089b5098cff7b9bc2be2f1645