Re: [PATCH v3 4/4] HID: wiimote: fix uaf when hid events are handled during destroy

Hi David,

It took me a while to get back to this one, because there was a bunch I
had to dig, and I had little time available these weeks.

On Fri Jul 31, 2026 at 8:17 AM -03, David Rheinsberg wrote:
> `hdev->driver_input_lock` serializes all probe/remove/event callbacks. Can you elaborate how this is triggered?
>
> I can see that external APIs like debugfs and other sysfs registrations can trigger this, but they are deinitialized before cancelling the work, aren't they?

Yes, you are right. This is a false alarm by sashiko.
wiidebug_deinit and device_remove_file are called before
cancel_work_sync(->queue.worker).
This is even more clear after my refactor of the wiimote_destroy
function (that I will send in the v4).

Before arriving at this conclusion, I tried adding delays to help
trigger the uaf with xwiimote, and failed :)

Thanks, I will drop this patch from the series.
Rafael Passos