Re: [PATCH 1/2] usb: gadget: f_hid: don't call copy_from_user() under get_report_spinlock

[Greg Kroah-Hartman]

On Sat, Sep 19, 2026 at 09:07:23AM +0000, Hui Peng wrote:
> f_hidg_get_report() already copies the incoming struct usb_hidg_report
> from userspace into the freshly allocated 'entry' before acquiring
> hidg->get_report_spinlock.
> 
> When a report with the same report_id is already present in
> hidg->report_list, the update path copies from userspace a second time,
> this time directly into ptr->report_data while the spinlock is held with
> interrupts disabled:
> 
> 	spin_lock_irqsave(&hidg->get_report_spinlock, flags);
> 	ptr = f_hidg_search_for_report(hidg, report_id);
> 	if (ptr) {
> 		if (copy_from_user(&ptr->report_data, buffer,
> 				sizeof(struct usb_hidg_report))) {
> 
> copy_from_user() may fault and sleep, so this is a sleeping function
> called from atomic context, reported by CONFIG_DEBUG_ATOMIC_SLEEP as
> "BUG: sleeping function called from invalid context". Userspace can
> reach it at will by issuing GADGET_HID_WRITE_GET_REPORT twice with the
> same report_id on /dev/hidgN.
> 
> The second copy is also redundant: the same user buffer has already been
> copied into entry->report_data a few lines above, and report_id was
> derived from that copy. Assign from the already copied data instead,
> which removes the fault from the critical section and makes the update
> atomic with respect to the list lookup.
> 
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
> ---
> Found by inspection while investigating the use-after-free fixed in
> patch 2/2, and build tested only; I do not have HID gadget hardware,
> but the path is reachable from /dev/hidgN with dummy_hcd.

what commit id does this fix?

thanks,

greg k-h