[PATCH] Input: cm109 - fix URB double-submit due to missing open check

[Xue Lei]

Add a dev->open check at the beginning of cm109_input_ev() to reject
events when the device is not open. There is no point in handling
input events for a device that has not been fully initialized.

The cm109 driver's event callback cm109_input_ev() can be invoked via
kd_mksound() -> input_inject_event() as soon as the input handle is
registered in kbd_connect(), which happens during
input_register_device() before cm109_input_open() has completed.
Without checking dev->open, the callback calls
cm109_toggle_buzzer_async() which submits urb_ctl while
cm109_input_open() is also about to submit the same URB, causing a
'list_add double add' BUG in usb_hcd_link_urb_to_ep().

Two crash scenarios have been observed:

Scenario 1: Same-CPU preemption (CONFIG_PREEMPT=y)

  During input_register_device(), kbd_connect() calls
  input_open_device() which invokes cm109_input_open(). Between
  setting ctl_urb_pending=1 and submitting the URB, the kworker
  thread is preempted by a process writing to a tty (triggering
  kd_mksound). The preempting process calls input_inject_event()
  -> cm109_input_ev() -> cm109_toggle_buzzer_async(), which sees
  ctl_urb_pending=0 (not yet set) and submits urb_ctl. When the
  kworker resumes, it also submits the same urb_ctl.

  CPU 0 (kworker)              CPU 0 (preempting)
  ---------------              ------------------
  input_open():
    // about to set pending=1
    <preempted>
                               input_ev():
                                 toggle_buzzer_async():
                                   ctl_urb_pending == 0
                                   submit_urb(urb_ctl) [1st]
    <resumes>
    ctl_urb_pending = 1
    submit_urb(urb_ctl) [2nd] --> CRASH

Scenario 2: Cross-CPU concurrency

  kbd_connect() has made the device handle visible to kd_mksound
  on CPU 1, but cm109_input_open() on CPU 0 has not yet finished.
  CPU 1 calls cm109_input_ev() first, sees dev->open=0 and
  ctl_urb_pending=0 (device was just kzalloc'd), and submits
  urb_ctl. Shortly after, CPU 0's cm109_input_open() also submits
  the same urb_ctl that is already on the endpoint list.

  CPU 0 (kworker)              CPU 1 (repro)
  ---------------              ---------------
  input_register_device()
    kbd_connect()
      input_register_handle()
                               kd_mksound() sees handle
      input_open_device()        input_ev():
        cm109_input_open():        toggle_buzzer_async():
          // not started yet         ctl_urb_pending == 0
                                     open == 0
                                     submit_urb [1st]
          ctl_urb_pending = 1
          submit_urb [2nd] --> CRASH

In both cases the root cause is that cm109_input_ev() does not
verify the device is open before triggering URB submission. Adding
the open check at function entry prevents the event callback from
racing with cm109_input_open() on URB submission.

Reported-by: syzbot+e69c25cf38a53d0cf64c@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=e69c25cf38a53d0cf64c
Fixes: c04148f915e5 ("Input: add driver for USB VoIP phones with CM109 chipset")
Signed-off-by: Xue Lei <Xue.Lei@xxxxxxxxxxxxx>
---
 drivers/input/misc/cm109.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/input/misc/cm109.c b/drivers/input/misc/cm109.c
index 353d3c1d347d..558cb73d5c6d 100644
--- a/drivers/input/misc/cm109.c
+++ b/drivers/input/misc/cm109.c
@@ -601,6 +601,9 @@ static int cm109_input_ev(struct input_dev *idev, unsigned int type,
 {
 	struct cm109_dev *dev = input_get_drvdata(idev);
 
+	if (!dev->open)
+		return -ENODEV;
+
 	dev_dbg(&dev->intf->dev,
 		"input_ev: type=%u code=%u value=%d\n", type, code, value);
 
-- 
2.43.0