Re: [PATCH v2] HID: hiddev: keep state alive through disconnect unlock

[Jiri Kosina]

On Mon, 29 Jun 2026, Yousef Alhouseen wrote:

> mutex_unlock() clears the mutex owner before taking its wait lock. A
> thread spinning in the final hiddev file release can acquire
> existancelock after hiddev_disconnect() clears the owner, then free
> hiddev before the disconnecting thread reaches the mutex wait lock. This
> causes a use-after-free in the mutex slow unlock path.
> 
> Give the connection and each open file an explicit reference. Drop each
> reference only after its existancelock critical section has completed,
> so neither unlock path can free the mutex while the other is still using
> it.
> 
> Fixes: 079034073faf ("HID: hiddev cleanup -- handle all error conditions properly")
> Reported-by: syzbot+563191a4939ddbfe73d4@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=563191a4939ddbfe73d4
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Yousef Alhouseen <alhouseenyousef@xxxxxxxxx>
> ---
> Changes in v2:
> - Explain the mutex owner-clear/spinning-contender race in the commit log.
> - No code changes.

Sorry for the long delay on this.

Thanks for fixing it, now applied.

-- 
Jiri Kosina
SUSE Labs