dan.carpenter@oracle.com 6263a83d39 HID: hiddev: Fix race in in hiddev_disconnect() ... commit 5c02c447eaeda29d3da121a2e17b97ccaf579b51 upstream. Syzbot reports that "hiddev" is used after it's free in hiddev_disconnect(). The hiddev_disconnect() function sets "hiddev->exist = 0;" so hiddev_release() can free it as soon as we drop the "existancelock" lock. This patch moves the mutex_unlock(&hiddev->existancelock) until after we have finished using it. Reported-by: syzbot+784ccb935f9900cc7c9e@syzkaller.appspotmail.com Fixes: 7f77897ef2 ("HID: hiddev: fix potential use-after-free") Suggested-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-03-05 16:42:19 +01:00
..
hid-core.c	HID: usbhid: use irqsave() in USB's complete callback	2018-06-25 15:24:46 +02:00
hid-pidff.c	HID: pidff: effect can't be NULL	2015-03-27 16:03:26 +01:00
hiddev.c	HID: hiddev: Fix race in in hiddev_disconnect()	2020-03-05 16:42:19 +01:00
Kconfig	docs: fix broken references with multiple hints	2018-06-15 18:10:01 -03:00
Makefile	HID: core: move the dynamic quirks handling in core	2017-11-21 11:14:48 +01:00
usbhid.h	HID: usbhid: do not rely on hid->open when deciding to do IO	2017-06-08 13:56:09 +02:00
usbkbd.c	HID: usbkbd: constify usb_device_id and fix space before '[' error.	2017-08-10 11:07:49 +02:00
usbmouse.c	HID: usbmouse: constify usb_device_id and fix space before '[' error	2017-08-10 11:07:49 +02:00