Unregister the LED controllers before device removal, as
bigben_set_led() may schedule bigben->worker after the structure has
been freed, causing a use-after-free.
Fixes: 4eb1b01de5b9 ("HID: hid-bigbenff: fix race condition for scheduled work during removal")
Signed-off-by: Pietro Borrello <borrello@xxxxxxxxxxxxxxxx>
---
drivers/hid/hid-bigbenff.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/hid/hid-bigbenff.c b/drivers/hid/hid-bigbenff.c
index e8b16665860d..d3201b755595 100644
--- a/drivers/hid/hid-bigbenff.c
+++ b/drivers/hid/hid-bigbenff.c
@@ -306,9 +306,14 @@ static enum led_brightness bigben_get_led(struct led_classdev *led)
static void bigben_remove(struct hid_device *hid)
{
+ int n;
struct bigben_device *bigben = hid_get_drvdata(hid);
bigben->removed = true;
+ for (n = 0; n < NUM_LEDS; n++) {
+ if (bigben->leds[n])
+ devm_led_classdev_unregister(&hid->dev, bigben->leds[n]);
+ }
cancel_work_sync(&bigben->worker);
hid_hw_stop(hid);
}
--
2.25.1
