Re: [PATCH 00/21] HID: fix racy force feedback initialization via .input_configured()

[Jiri Kosina]

On Mon, 3 Aug 2026, Dmitry Torokhov wrote:

> When a HID driver calls hid_hw_start() with the HID_CONNECT_HIDINPUT
> flag (included in HID_CONNECT_DEFAULT), the HID core immediately registers
> the input device with the input subsystem, making it live and accessible to
> userspace.
> 
> Historically, many HID drivers initialized force-feedback capabilities (via
> input_ff_create_memless() or custom workqueues) in their probe() callback
> after calling hid_hw_start(). This introduces a window where userspace can
> open the input node and trigger force-feedback ioctls before the driver has
> finished preparing its private structures or workqueues, leading to potential
> NULL pointer dereferences and race conditions.

Hm, this has probably been the case for ages indeed. Thanks for noticing.

> To eliminate this anti-pattern across the subsystem, this series:
> - Enhances the HID core to automatically handle driver force-feedback
>   initialization during input device registration.
> - Refactors individual HID drivers to perform all force-feedback setup
>   inside the .input_configured() callback, ensuring the input device is
>   fully prepared before it is exposed to userspace.
> - Adds documentation and a Coccinelle script to prevent future regressions.
> 
> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>

Now queued in hid.git#for-7.3/core.

Thanks,

-- 
Jiri Kosina
SUSE Labs