Re: [PATCH 1/1] HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure

[Lee Jones]

On Tue, 03 Mar 2026, Günther Noack wrote:

> On Fri, Feb 27, 2026 at 10:09:38AM +0000, Lee Jones wrote:
> > Presently, if the force feedback initialisation fails when probing the
> > Logitech G920 Driving Force Racing Wheel for Xbox One, an error number
> > will be returned and propagated before the userspace infrastructure
> > (sysfs and /dev/input) has been torn down.  If userspace ignores the
> > errors and continues to use its references to these dangling entities, a
> > UAF will promptly follow.
> > 
> > We have 2 options; continue to return the error, but ensure that all of
> > the infrastructure is torn down accordingly or continue to treat this
> > condition as a warning by emitting the message but returning success.
> > It is thought that the original author's intention was to emit the
> > warning but keep the device functional, less the force feedback feature,
> > so let's go with that.
> > 
> > Signed-off-by: Lee Jones <lee@xxxxxxxxxx>
> > ---
> >  drivers/hid/hid-logitech-hidpp.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
> > index e871f1729d4b..eee9ab6a2fc4 100644
> > --- a/drivers/hid/hid-logitech-hidpp.c
> > +++ b/drivers/hid/hid-logitech-hidpp.c
> > @@ -4487,10 +4487,12 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
> >  		if (!ret)
> >  			ret = hidpp_ff_init(hidpp, &data);
> >  
> > -		if (ret)
> > +		if (ret) {
> >  			hid_warn(hidpp->hid_dev,
> >  		     "Unable to initialize force feedback support, errno %d\n",
> >  				 ret);
> > +			ret = 0;
> > +		}
> >  	}
> >  
> >  	/*
> > -- 
> > 2.53.0.473.g4a7958ca14-goog
> > 
> 
> Reviewed-by: Günther Noack <gnoack@xxxxxxxxxx>

What are the subsystem preferences in terms of pokes or [RESENDS], please?

I'm happy to submit a [RESEND] if that's required to get this back into view.

-- 
Lee Jones [李琼斯]