![]() Syzbot reports that "hiddev" is used after it's free in hiddev_disconnect().
The hiddev_disconnect() function sets "hiddev->exist = 0;" so
hiddev_release() can free it as soon as we drop the "existancelock"
lock. This patch moves the mutex_unlock(&hiddev->existancelock) until
after we have finished using it.
Reported-by: syzbot+784ccb935f9900cc7c9e@syzkaller.appspotmail.com
Fixes:
|
||
---|---|---|
.. | ||
hid-core.c | ||
hid-pidff.c | ||
hiddev.c | ||
Kconfig | ||
Makefile | ||
usbhid.h | ||
usbkbd.c | ||
usbmouse.c |