HID: hiddev: Fix race in in hiddev_disconnect()
authordan.carpenter@oracle.com <dan.carpenter@oracle.com>
Wed, 15 Jan 2020 17:46:28 +0000 (20:46 +0300)
committerJiri Kosina <jkosina@suse.cz>
Wed, 12 Feb 2020 13:46:56 +0000 (14:46 +0100)
commit5c02c447eaeda29d3da121a2e17b97ccaf579b51
tree02a1c1bedb8f91014706175750a496fddb508bfe
parent84a4062632462c4320704fcdf8e99e89e94c0aba
HID: hiddev: Fix race in in hiddev_disconnect()

Syzbot reports that "hiddev" is used after it's free in hiddev_disconnect().
The hiddev_disconnect() function sets "hiddev->exist = 0;" so
hiddev_release() can free it as soon as we drop the "existancelock"
lock.  This patch moves the mutex_unlock(&hiddev->existancelock) until
after we have finished using it.

Reported-by: syzbot+784ccb935f9900cc7c9e@syzkaller.appspotmail.com
Fixes: 7f77897ef2b6 ("HID: hiddev: fix potential use-after-free")
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
drivers/hid/usbhid/hiddev.c