Re: [PATCH v2] Input: byd - synchronize timer deletion before freeing private data

[Dmitry Torokhov]

On Mon, Jul 20, 2026 at 02:12:59PM +0800, Linmao Li wrote:
> byd_disconnect() uses timer_delete() before freeing the driver's private
> data.  This does not wait for a running byd_clear_touch() callback, which
> dereferences the private data and its psmouse pointer.  A callback racing
> with disconnect can therefore access the private data after it has been
> freed.  The timer can also still be re-armed by byd_process_byte() while
> the disconnect is in progress.
> 
> Use timer_shutdown_sync() before freeing the private data: it waits for
> a running callback and turns any later re-arm attempt into a no-op.
> 
> Fixes: 2d5f5611dd0d ("Input: byd - enable absolute mode")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Linmao Li <lilinmao@xxxxxxxxxx>

Applied, thank you.

-- 
Dmitry