Re: [PATCH] HID: sensor-custom: Synchronize misc-device teardown with file lifetime

[Joshua Crofts]

On 2026-11-02 17:57, Srinivas Pandruvada wrote:
> The HID sensor custom misc device frees its per-sensor state in
> remove() while userspace may still hold an open file descriptor. A
> reader blocked in read() can remain queued on sensor_inst->wait after the
> object has been freed, and a later wakeup races with teardown and
> touches stale memory.
> 
> Synchronize the misc-device teardown with file lifetime before freeing
> the per-sensor state. Set a removal flag, reject new opens, wake
> blocked waiters, and wait for the last open file to close before
> deregistering the misc device and freeing the FIFO. Fail in-flight read()
> and poll() operations cleanly once removal is in progress so userspace
> cannot access freed memory after the device disappears.
> 
> This avoids use-after-free on read(), poll(), release(), and open()
> after the HID sensor custom character device has been removed
> 
> Reported-by: Семён Марьясин <simeon@xxxxxxxxxxxxx>

Closes tag?

> Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@xxxxxxxxxxxxxxx>

-- 
Kind regards,
Joshua Crofts