• Jiri Kosina's avatar
    HID: hiddev: fix race between hiddev_disconnect and hiddev_release · 6cb4b040
    Jiri Kosina authored
    When hiddev_disconnect() runs with chardev open, it will proceed with
    usbhid_close(). When userspace in parallel runs the hiddev_release(),
    it sees !hiddev->exists (as it has been already set so by
    hiddev_disconnect()) and kfrees hiddev while hiddev_disconnect() hasn't
    finished yet.
    
    Serialize the access to hiddev->exists and hiddev->open by existancelock.
    
    Reported-by: mike-@cinci.rr.com
    Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
    6cb4b040
hiddev.c 22 KB