On Thu, 05 Oct 2023 20:26:38 +0200, Hans de Goede wrote:
> hidpp_connect_event() has *four* time-of-check vs time-of-use (TOCTOU)
> races when it races with itself.
>
> hidpp_connect_event() primarily runs from a workqueue but it also runs
> on probe() and if a "device-connected" packet is received by the hw
> when the thread running hidpp_connect_event() from probe() is waiting on
> the hw, then a second thread running hidpp_connect_event() will be
> started from the workqueue.
>
> [...]
Applied to hid/hid.git (for-6.6/upstream-fixes), thanks!
[1/1] HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
https://git.kernel.org/hid/hid/c/dac501397b9d
Cheers,
--
Benjamin Tissoires <bentiss@xxxxxxxxxx>
