Patch "HID: uclogic: Correct devm device reference for hidinput input_dev name" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    HID: uclogic: Correct devm device reference for hidinput input_dev name

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     hid-uclogic-correct-devm-device-reference-for-hidinp.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit c7a1a0314dee8d50a3960f773b42c4d45ba5be9f
Author: Rahul Rameshbabu <sergeantsagara@xxxxxxxxxxxxxx>
Date:   Thu Aug 24 06:14:17 2023 +0000

    HID: uclogic: Correct devm device reference for hidinput input_dev name
    
    [ Upstream commit dd613a4e45f8d35f49a63a2064e5308fa5619e29 ]
    
    Reference the HID device rather than the input device for the devm
    allocation of the input_dev name. Referencing the input_dev would lead to a
    use-after-free when the input_dev was unregistered and subsequently fires a
    uevent that depends on the name. At the point of firing the uevent, the
    name would be freed by devres management.
    
    Use devm_kasprintf to simplify the logic for allocating memory and
    formatting the input_dev name string.
    
    Reported-by: syzbot+3a0ebe8a52b89c63739d@xxxxxxxxxxxxxxxxxxxxxxxxx
    Closes: https://lore.kernel.org/linux-input/ZOZIZCND+L0P1wJc@penguin/T/
    Reported-by: Maxime Ripard <mripard@xxxxxxxxxx>
    Closes: https://lore.kernel.org/linux-input/ZOZIZCND+L0P1wJc@penguin/T/#m443f3dce92520f74b6cf6ffa8653f9c92643d4ae
    Fixes: cce2dbdf258e ("HID: uclogic: name the input nodes based on their tool")
    Suggested-by: Maxime Ripard <mripard@xxxxxxxxxx>
    Suggested-by: Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
    Signed-off-by: Rahul Rameshbabu <sergeantsagara@xxxxxxxxxxxxxx>
    Reviewed-by: Maxime Ripard <mripard@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230824061308.222021-2-sergeantsagara@xxxxxxxxxxxxxx
    Signed-off-by: Benjamin Tissoires <bentiss@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c
index bfbb51f8b5beb..39114d5c55a0e 100644
--- a/drivers/hid/hid-uclogic-core.c
+++ b/drivers/hid/hid-uclogic-core.c
@@ -85,10 +85,8 @@ static int uclogic_input_configured(struct hid_device *hdev,
 {
 	struct uclogic_drvdata *drvdata = hid_get_drvdata(hdev);
 	struct uclogic_params *params = &drvdata->params;
-	char *name;
 	const char *suffix = NULL;
 	struct hid_field *field;
-	size_t len;
 	size_t i;
 	const struct uclogic_params_frame *frame;
 
@@ -146,14 +144,9 @@ static int uclogic_input_configured(struct hid_device *hdev,
 		}
 	}
 
-	if (suffix) {
-		len = strlen(hdev->name) + 2 + strlen(suffix);
-		name = devm_kzalloc(&hi->input->dev, len, GFP_KERNEL);
-		if (name) {
-			snprintf(name, len, "%s %s", hdev->name, suffix);
-			hi->input->name = name;
-		}
-	}
+	if (suffix)
+		hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL,
+						 "%s %s", hdev->name, suffix);
 
 	return 0;
 }