Linux hid-sensor-custom race condition vuln & fix

Summary of Key Vulnerability Information Vulnerability Overview Vulnerability Type: Race Condition Vulnerability Description: In the driver, the sysfs attribute, when calling within , references and . These pointers point to entries initialized in ; however, depends on the sysfs attribute being exposed before is executed, leading to concurrent access to uninitialized memory. Remediation: Expose the sysfs attribute before creating the field attributes within , ensuring that is not accessible prior to the initialization of . During , delete before freeing the field attributes to prevent concurrent file access from referencing freed memory. Impact Scope Affected Component: driver Affected Version: Linux kernel stable branch (linux.git) Impact Scope: Systems using the driver, particularly scenarios involving the management of sensor power state and report state. Remediation Fix Commit: Fix Details: - In the function, the creation order of was adjusted to ensure the sysfs attribute is exposed before initialization. - In the function, the deletion order of was adjusted to ensure the sysfs attribute is removed before the field attributes are freed. POC/Exploit Code ```c diff --git a/drivers/hid/hid-sensor-custom.c b/drivers/hid/hid-sensor-custom.c index 4a065d9a7268..77c17b4f41e 100644 --- a/drivers/hid/hid-sensor-custom.c +++ b/drivers/hid/hid-sensor-custom.c @@ -910,26 +910,26 @@ static int hid_sensor_custom_probe(struct platform_device pdev) return ret; } err_remove_attributes: hid_sensor_custom_remove_attributes(sensor_inst); err_remove_group: sysfs_remove_group(&sensor_inst->pdev->dev.kobj, &enable_sensor_attr_group); err_remove_callback: hid_sensor_custom_remove_callback(hdev, hdev->usage); err_remove_attributes: hid_sensor_custom_remove_attributes(sensor_inst); err_remove_group: sysfs_remove_group(&sensor_inst->pdev->dev.kobj, &enable_sensor_attr_group); err_remove_callback: hid_sensor_custom_remove_callback(hdev, hdev->usage); return 0; } @@ -947,9 +947,10 @@ static int hid_sensor_custom_remove(struct platform_device pdev) { struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_sensor_custom_dev sensor_custom_dev = platform_get_drvdata(pdev); struct hid_s

Goal Reached Thanks to every supporter — we hit 100%!

Linux hid-sensor-custom race condition vuln & fix