Commit 7f77897e authored by Jiri Kosina's avatar Jiri Kosina

HID: hiddev: fix potential use-after-free

Commit 6cb4b040 ("HID: hiddev: fix race between hiddev_disconnect
and hiddev_release") made it possible to access hiddev (for unlocking
the existance mutex) once hiddev has been kfreed.

Change the order so that this can not happen (always unlock the mutex first,
it is needed only to protect access to ->exist and ->open).
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent d762f438
......@@ -923,10 +923,11 @@ void hiddev_disconnect(struct hid_device *hid)
usb_deregister_dev(usbhid->intf, &hiddev_class);
if (hiddev->open) {
mutex_unlock(&hiddev->existancelock);
usbhid_close(hiddev->hid);
wake_up_interruptible(&hiddev->wait);
} else {
mutex_unlock(&hiddev->existancelock);
kfree(hiddev);
}
mutex_unlock(&hiddev->existancelock);
}
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment