diff options
| author | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2026-08-03 16:48:11 -0700 |
|---|---|---|
| committer | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2026-08-05 23:01:44 -0700 |
| commit | 8c3ff3164b6ec28f2977f71645a5e6d7fde06924 (patch) | |
| tree | a5ca19dfb9717f95246a389c5559ccd60cc7b009 /drivers/input | |
| parent | 876848ad2203d225e927a5f3373900bcbb73c9c5 (diff) | |
Input: reject inhibit and uninhibit requests on unregistering devices
When an input device is being unregistered via input_unregister_device(),
input_disconnect_device() sets dev->going_away = true under dev->mutex
and releases the mutex.
If a concurrent sysfs write to the inhibited attribute executes
input_inhibit_device() or input_uninhibit_device(), it acquires
dev->mutex. Because neither function checks dev->going_away (unlike
input_open_device()), input_uninhibit_device() proceeds to call
dev->open() and start polling on a device that is in the middle of being
unregistered and torn down.
Fix this by checking dev->going_away in input_inhibit_device() and
input_uninhibit_device() under dev->mutex and returning -ENODEV if the
device is going away.
Fixes: a181616487db ("Input: Add "inhibited" property")
Reported-by: sashiko-bot@kernel.org
Assisted-by: Antigravity:gemini-3.6-flash
Link: https://patch.msgid.link/anEolqA35rGei9ql@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Diffstat (limited to 'drivers/input')
| -rw-r--r-- | drivers/input/input.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/input/input.c b/drivers/input/input.c index c9f480629099..78c10eea7328 100644 --- a/drivers/input/input.c +++ b/drivers/input/input.c @@ -1788,6 +1788,9 @@ static int input_inhibit_device(struct input_dev *dev) { guard(mutex)(&dev->mutex); + if (dev->going_away) + return -ENODEV; + if (dev->inhibited) return 0; @@ -1821,6 +1824,9 @@ static int input_uninhibit_device(struct input_dev *dev) guard(mutex)(&dev->mutex); + if (dev->going_away) + return -ENODEV; + if (!dev->inhibited) return 0; |