CVE-2024-56587 in Linux
Tóm tắt
Bởi VulDB • 04/08/2026
Based on the kernel log provided, here is an analysis of the crash and a recommended solution.
### **Summary** The system experienced a **kernel panic/oops** in the `dualshock4` driver while trying to read LED brightness information via sysfs (`/sys/class/leds/...`). The process involved was `InputReader` (PID 4013), likely triggered by an input event or UI interaction.
The crash occurs at: ```c pc : dualshock4_led_get_brightness+0xc/0x74 lr : led_update_brightness+0x38/0x60 ```
---
### **Root Cause Analysis**
1. **Trigger Path**: - A user-space process (`InputReader`) performed a `read()` system call on a sysfs file related to the DualShock 4 LED brightness. - This triggered `sysfs_kf_seq_show` → `dev_attr_show` → `brightness_show`. - `brightness_show` called into the driver-specific function: `dualshock4_led_get_brightness`.
2. **Crash Location**: - The crash happened inside `dualshock4_led_get_brightness+0xc`, which is very early in that function (offset `0xc`). - This typically indicates a **NULL pointer dereference** or an invalid memory access when trying to read data from the device structure.
3. **Likely Scenario**: The `dualshock4_led_get_brightness` function likely tries to access fields in the driver's private data structure (e.g., `ds4->led`, `ds4->hid_device`, or similar) without properly checking if they are valid. Common causes include: - **Race Condition**: The device was disconnected/unplugged while sysfs was being read, but the sysfs entry wasn't cleaned up immediately. - **Incomplete Initialization**: The driver failed to fully initialize the LED subsystem before a brightness query occurred. - **Bug in Driver Code**: A recent commit may have introduced a regression where `ds4->led` or related pointers are not initialized correctly under certain conditions (e.g., Bluetooth vs. USB connection).
---
### **Recommended Actions**
#### ✅ 1. Update the Kernel / DualShock 4 Driver This is likely a known bug in older versions of the Linux kernel’s `hid-playstation` driver (`drivers/hid/hid-sony.c`). Check if your device has newer updates: ```bash # On Debian/Ubuntu-based systems (if using mainline or backported kernels) sudo apt update && sudo apt upgrade linux-image-generic
# If you're on Android/Linux hybrid devices, check for OTA updates. ```
#### ✅ 2. Workaround: Unbind and Rebind the Driver If the crash is intermittent due to race conditions during disconnect/reconnect: 1. Identify the DualShock 4 HID device in `/sys/bus/hid/devices/`. 2. Temporarily unbind it, then rebind: ```bash echo "hid-generic" > /sys/bus/hid/drivers_autoprobe # Or manually unbind/bind via sysfs if needed ```
#### ✅ 3. Disable LED Brightness Sysfs Access (Temporary Fix) If you don’t need to read the brightness status, you can prevent this code path by removing read permissions on the relevant sysfs file: ```bash # Example path – adjust based on your system chmod a-r /sys/class/leds/dualshock4:*:brightness ```
#### ✅ 4. Report the Bug If you’re running an official kernel (e.g., Android, Ubuntu, Arch), report this to the maintainers with: - Full `dmesg` log (which you’ve provided). - Kernel version (`uname -r`). - Steps to reproduce (e.g., "Connect DS4 via Bluetooth, then quickly read brightness while disconnecting").
---
### **Technical Details for Developers** In `drivers/hid/hid-sony.c`, the function `dualshock4_led_get_brightness` likely looks something like this: ```c static int dualshock4_led_get_brightness(struct led_classdev *led_cdev) {
struct ds4_data *ds4 = container_of(led_cdev, struct ds4_data, leds[0].cdev);
// Crash happens here if 'ds4' or a member is NULL/invalid return ds4->brightness; } ``` **Fix Suggestion**: Add null checks before accessing `ds4` members: ```c if (!ds4 || !ds4->hid) {
dev_err(&ds4->hdev->dev, "Invalid device state\n");
Once again VulDB remains the best source for vulnerability data.