Re: [PATCH 1/1] HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure

[Lee Jones]

On Mon, 16 Mar 2026, Benjamin Tissoires wrote:

> On Mar 16 2026, Lee Jones wrote:
> > On Tue, 03 Mar 2026, Günther Noack wrote:
> > 
> > > On Fri, Feb 27, 2026 at 10:09:38AM +0000, Lee Jones wrote:
> > > > Presently, if the force feedback initialisation fails when probing the
> > > > Logitech G920 Driving Force Racing Wheel for Xbox One, an error number
> > > > will be returned and propagated before the userspace infrastructure
> > > > (sysfs and /dev/input) has been torn down.  If userspace ignores the
> > > > errors and continues to use its references to these dangling entities, a
> > > > UAF will promptly follow.
> > > > 
> > > > We have 2 options; continue to return the error, but ensure that all of
> > > > the infrastructure is torn down accordingly or continue to treat this
> > > > condition as a warning by emitting the message but returning success.
> > > > It is thought that the original author's intention was to emit the
> > > > warning but keep the device functional, less the force feedback feature,
> > > > so let's go with that.
> > > > 
> > > > Signed-off-by: Lee Jones <lee@xxxxxxxxxx>
> > > > ---
> > > >  drivers/hid/hid-logitech-hidpp.c | 4 +++-
> > > >  1 file changed, 3 insertions(+), 1 deletion(-)
> > > > 
> > > > diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
> > > > index e871f1729d4b..eee9ab6a2fc4 100644
> > > > --- a/drivers/hid/hid-logitech-hidpp.c
> > > > +++ b/drivers/hid/hid-logitech-hidpp.c
> > > > @@ -4487,10 +4487,12 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
> > > >  		if (!ret)
> > > >  			ret = hidpp_ff_init(hidpp, &data);
> > > >  
> > > > -		if (ret)
> > > > +		if (ret) {
> > > >  			hid_warn(hidpp->hid_dev,
> > > >  		     "Unable to initialize force feedback support, errno %d\n",
> > > >  				 ret);
> > > > +			ret = 0;
> > > > +		}
> > > >  	}
> > > >  
> > > >  	/*
> > > > -- 
> > > > 2.53.0.473.g4a7958ca14-goog
> > > > 
> > > 
> > > Reviewed-by: Günther Noack <gnoack@xxxxxxxxxx>
> > 
> > What are the subsystem preferences in terms of pokes or [RESENDS], please?
> 
> Just send a gently ping like this on the thread, this will make it pop
> up in our mailboxes :)
> 
> > 
> > I'm happy to submit a [RESEND] if that's required to get this back into view.
> 
> Nah, no need to send a [RESEND] when the patch is just a couple of weeks
> old.

Understood, thank you.

-- 
Lee Jones [李琼斯]