]> git.ipfire.org Git - thirdparty/linux.git/commit
usb: gadget: f_hid: don't call cdev_init while cdev in use
authorMichael Zimmermann <sigmaepsilon92@gmail.com>
Fri, 27 Mar 2026 19:22:09 +0000 (20:22 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 30 Mar 2026 14:58:54 +0000 (16:58 +0200)
commit81ebd43cc0d6d106ce7b6ccbf7b5e40ca7f5503d
treeccfcef90b75cdbda65a0dac0ef77d9ac9f8e29b5
parent0c8935642cb08c2b64cc4264ac751298994edd8a
usb: gadget: f_hid: don't call cdev_init while cdev in use

When calling unbind, then bind again, cdev_init reinitialized the cdev,
even though there may still be references to it. That's the case when
the /dev/hidg* device is still opened. This obviously unsafe behavior
like oopes.

This fixes this by using cdev_alloc to put the cdev on the heap. That
way, we can simply allocate a new one in hidg_bind.

Closes: https://lore.kernel.org/linux-usb/CAN9vWDKZn0Ts5JyV2_xcAmbnBEi0znMLg_USMFrShRryXrgWGQ@mail.gmail.com/T/#m2cb0dba3633b67b2a679c98499508267d1508881
Cc: stable <stable@kernel.org>
Signed-off-by: Michael Zimmermann <sigmaepsilon92@gmail.com>
Link: https://patch.msgid.link/20260327192209.59945-1-sigmaepsilon92@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/gadget/function/f_hid.c