[PATCH] HID: mcp2221: stop device IO before hid_hw_stop

[Jiangshan Yi]

mcp2221_probe() calls hid_device_io_start() to allow synchronous HID
transactions during setup.  If probe fails afterwards, the devm cleanup
callback mcp2221_hid_unregister() calls hid_hw_close()/hid_hw_stop()
without first calling hid_device_io_stop().

hid_hw_stop() does not stop device IO, so hid_input_report() may still
be delivered and access driver data being freed, causing a
use-after-free.  The same window exists on normal device removal.

Call hid_device_io_stop() at the top of mcp2221_hid_unregister() so
that IO is quiesced before the hardware is stopped in both the error
and remove paths.

Fixes: d4b50ac06ea6 ("HID: mcp2221: Allow IO to start during probe")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jiangshan Yi <yijiangshan@xxxxxxxxxx>
---
 drivers/hid/hid-mcp2221.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hid/hid-mcp2221.c b/drivers/hid/hid-mcp2221.c
index e4ddd8e9293b..83857ec1d61c 100644
--- a/drivers/hid/hid-mcp2221.c
+++ b/drivers/hid/hid-mcp2221.c
@@ -1049,6 +1049,7 @@ static void mcp2221_hid_unregister(void *ptr)
 {
 	struct hid_device *hdev = ptr;
 
+	hid_device_io_stop(hdev);
 	hid_hw_close(hdev);
 	hid_hw_stop(hdev);
 }
-- 
2.25.1