diff options
| author | [email protected] <[email protected]> | 2020-01-15 17:46:28 +0000 |
|---|---|---|
| committer | Jiri Kosina <[email protected]> | 2020-02-12 13:46:56 +0000 |
| commit | 5c02c447eaeda29d3da121a2e17b97ccaf579b51 (patch) | |
| tree | 02a1c1bedb8f91014706175750a496fddb508bfe /tools/perf/scripts | |
| parent | HID: core: increase HID report buffer size to 8KiB (diff) | |
| download | kernel-5c02c447eaeda29d3da121a2e17b97ccaf579b51.tar.gz kernel-5c02c447eaeda29d3da121a2e17b97ccaf579b51.zip | |
HID: hiddev: Fix race in in hiddev_disconnect()
Syzbot reports that "hiddev" is used after it's free in hiddev_disconnect().
The hiddev_disconnect() function sets "hiddev->exist = 0;" so
hiddev_release() can free it as soon as we drop the "existancelock"
lock. This patch moves the mutex_unlock(&hiddev->existancelock) until
after we have finished using it.
Reported-by: [email protected]
Fixes: 7f77897ef2b6 ("HID: hiddev: fix potential use-after-free")
Suggested-by: Alan Stern <[email protected]>
Signed-off-by: Dan Carpenter <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
Diffstat (limited to 'tools/perf/scripts')
0 files changed, 0 insertions, 0 deletions