| Message ID | 20230125-hid-unregister-leds-v1-2-9a5192dcef16@diag.uniroma1.it (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Jiri Kosina |
| Headers | show |
| Series | HID: manually unregister leds on device removal to prevent UAFs | expand |
diff --git a/drivers/hid/hid-asus.c b/drivers/hid/hid-asus.c index f99752b998f3..0f274c8d1bef 100644 --- a/drivers/hid/hid-asus.c +++ b/drivers/hid/hid-asus.c @@ -1122,6 +1122,7 @@ static void asus_remove(struct hid_device *hdev) if (drvdata->kbd_backlight) { drvdata->kbd_backlight->removed = true; + devm_led_classdev_unregister(&hdev->dev, &drvdata->kbd_backlight->cdev); cancel_work_sync(&drvdata->kbd_backlight->work); }
Unregister the LED controller before device removal, as asus_kbd_backlight_set() may schedule led->work after the structure has been freed, causing a use-after-free. Fixes: af22a610bc38 ("HID: asus: support backlight on USB keyboards") Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it> --- drivers/hid/hid-asus.c | 1 + 1 file changed, 1 insertion(+)