From patchwork Sun May 29 12:11:24 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Manuel Reimer X-Patchwork-Id: 9139757 X-Patchwork-Delegate: jikos@jikos.cz Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 6345460467 for ; Sun, 29 May 2016 12:11:39 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 47D2B25819 for ; Sun, 29 May 2016 12:11:39 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 2B6942807E; Sun, 29 May 2016 12:11:39 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 73B1525819 for ; Sun, 29 May 2016 12:11:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932139AbcE2MLf (ORCPT ); Sun, 29 May 2016 08:11:35 -0400 Received: from mx1.mailbox.org ([80.241.60.212]:49330 "EHLO mx1.mailbox.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932137AbcE2MLe (ORCPT ); Sun, 29 May 2016 08:11:34 -0400 Received: from smtp1.mailbox.org (smtp1.mailbox.org [80.241.60.240]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.mailbox.org (Postfix) with ESMTPS id 7E66B43F55; Sun, 29 May 2016 14:11:27 +0200 (CEST) X-Virus-Scanned: amavisd-new at heinlein-support.de Received: from smtp1.mailbox.org ([80.241.60.240]) by gerste.heinlein-support.de (gerste.heinlein-support.de [91.198.250.173]) (amavisd-new, port 10030) with ESMTP id HAAJ3OdW6mQY; Sun, 29 May 2016 14:11:25 +0200 (CEST) To: linux-input From: Manuel Reimer Subject: [PATCH] hid-sony: Prevent crash when rumble effects are still loaded at USB disconnect Cc: jikos@kernel.org Message-ID: Date: Sun, 29 May 2016 14:11:24 +0200 MIME-Version: 1.0 Sender: linux-input-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-input@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Hello, I had a deeper look at the kernel panic, happening if there are rumble effects loaded and the USB plug is pulled. The reason for this is similar to the one, I fixed in uinput some days ago. In "sony_remove" the memory for "output_report_dmabuf" is freed. Then, a few lines later, "hid_hw_stop" is called. This now tries to cleanup and causes ff_memless to try to send out a new rumble event which should turn both motor speeds to zero. To get this processed, "sc->send_output_report" is called, which, for example, ends up in "dualshock4_send_output_report". This function will now use the, already freed, "output_report_dmabuf". My patch zeroes out "output_report_dmabuf" after freeing and checks for this in the "send_output_report" functions. There may be other ways to fix this, so please tell me if you prefer some other way. I've added a one-line comment above the memory pointer check, as, in my opinion, it is not obvious what is happening here. Signed-off-by: Manuel Reimer --- To unsubscribe from this list: send the line "unsubscribe linux-input" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html --- a/drivers/hid/hid-sony.c 2016-05-13 16:13:00.339346161 +0200 +++ b/drivers/hid/hid-sony.c 2016-05-29 13:54:25.452029787 +0200 @@ -1809,6 +1809,10 @@ static void sixaxis_send_output_report(s (struct sixaxis_output_report *)sc->output_report_dmabuf; int n; + /* If called via hid_hw_stop, then our memory is already gone! */ + if (!report) + return; + /* Initialize the report with default values */ memcpy(report, &default_report, sizeof(struct sixaxis_output_report)); @@ -1853,6 +1857,10 @@ static void dualshock4_send_output_repor __u8 *buf = sc->output_report_dmabuf; int offset; + /* If called via hid_hw_stop, then our memory is already gone! */ + if (!buf) + return; + if (sc->quirks & DUALSHOCK4_CONTROLLER_USB) { memset(buf, 0, DS4_REPORT_0x05_SIZE); buf[0] = 0x05; @@ -1899,6 +1907,10 @@ static void motion_send_output_report(st struct motion_output_report_02 *report = (struct motion_output_report_02 *)sc->output_report_dmabuf; + /* If called via hid_hw_stop, then our memory is already gone! */ + if (!report) + return; + memset(report, 0, MOTION_REPORT_0x02_SIZE); report->type = 0x02; /* set leds */ @@ -2426,6 +2438,7 @@ static void sony_remove(struct hid_devic sony_cancel_work_sync(sc); kfree(sc->output_report_dmabuf); + sc->output_report_dmabuf = NULL; sony_remove_dev_list(sc);