Re: [PATCH] HID: winwing: fix use-after-free in force feedback teardown

[Jiri Kosina]

On Wed, 12 Aug 2026, René Onier wrote:

> winwing_init_ff() passes the driver's private data, allocated with
> devm_kzalloc() in winwing_probe(), as the effect context to
> input_ff_create_memless(). The memoryless force-feedback core takes
> ownership of that pointer and frees it with kfree() from
> input_ff_destroy() (ml_ff_destroy()) when the input device is
> destroyed.
> 
> Freeing a devm-managed allocation with kfree() is an invalid free, and
> the same object is then released again by devres when the HID device is
> torn down, a double free. As the allocation also embeds the LED class
> devices, their timers and work item live on freed memory and the slab
> gets corrupted. This triggers on unbind, rmmod, hot-unplug and on system
> suspend, where the firmware cache walks the now-corrupt devres list.
> KASAN reports:
> 
>   BUG: KASAN: invalid-free in input_ff_destroy
>   Allocated by task N:
>     winwing_probe
> 
> Pass NULL as the memless context instead and fetch the driver data from
> the input device in winwing_play_effect(): the HID core already stores
> the hid_device as the input device's drvdata. The force-feedback core
> then owns nothing that it must not free.
> 
> Fixes: 42d020b54edc ("HID: winwing: Enable rumble effects")
> Signed-off-by: René Onier <f3nr1l@xxxxxx>

Applied, thanks.

-- 
Jiri Kosina
SUSE Labs