Re: [PATCH] HID: mcp2221: stop device IO before hid_hw_stop

[Jiri Kosina]

On Tue, 28 Jul 2026, Jiangshan Yi wrote:

> mcp2221_probe() calls hid_device_io_start() to allow synchronous HID
> transactions during setup.  If probe fails afterwards, the devm cleanup
> callback mcp2221_hid_unregister() calls hid_hw_close()/hid_hw_stop()
> without first calling hid_device_io_stop().
> 
> hid_hw_stop() does not stop device IO, so hid_input_report() may still
> be delivered and access driver data being freed, causing a
> use-after-free.  The same window exists on normal device removal.
> 
> Call hid_device_io_stop() at the top of mcp2221_hid_unregister() so
> that IO is quiesced before the hardware is stopped in both the error
> and remove paths.

Applied, thanks.

-- 
Jiri Kosina
SUSE Labs