5c02c447ea
Syzbot reports that "hiddev" is used after it's free in hiddev_disconnect().
The hiddev_disconnect() function sets "hiddev->exist = 0;" so
hiddev_release() can free it as soon as we drop the "existancelock"
lock. This patch moves the mutex_unlock(&hiddev->existancelock) until
after we have finished using it.
Reported-by: syzbot+784ccb935f9900cc7c9e@syzkaller.appspotmail.com
Fixes:
|
||
|---|---|---|
| .. | ||
| hid-core.c | ||
| hid-pidff.c | ||
| hiddev.c | ||
| Kconfig | ||
| Makefile | ||
| usbhid.h | ||
| usbkbd.c | ||
| usbmouse.c | ||