Re: [PATCH] HID: synchronize input before cleaning up a failed probe

On Sun, 28 Jun 2026, Yousef Alhouseen wrote:

> hid_device_io_start() allows reports to run concurrently with probe. If
> the probe subsequently fails, __hid_device_probe() releases driver
> resources and clears hdev->driver without first excluding those report
> callbacks.
> 
> For example, a report may enter hidraw_report_event() while the failure
> path frees the associated hidraw object, leading to a use-after-free when
> the report takes the object's list lock.
> 
> Stop input before performing failed-probe cleanup. This reacquires
> driver_input_lock and waits for any report callback already in progress.

Makes me wonder why we haven't seen this happening in the wild here and 
there. It doesn't seem completely unlikely.

Applied, thanks.

-- 
Jiri Kosina
SUSE Labs