From: Yousef Alhouseen <alhouseenyousef@gmail.com> stable inclusion from stable-v5.10.270 commit 3ffb088a2ed34ca982cfc2c81d107ce370aa45f1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19484 CVE: CVE-2026-90329 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... ------------------------------ [ Upstream commit 207853d46f7ef2e28042344a1468da8754c3ddbf ] hid_device_io_start() allows reports to run concurrently with probe. If the probe subsequently fails, __hid_device_probe() releases driver resources and clears hdev->driver without first excluding those report callbacks. For example, a report may enter hidraw_report_event() while the failure path frees the associated hidraw object, leading to a use-after-free when the report takes the object's list lock. Stop input before performing failed-probe cleanup. This reacquires driver_input_lock and waits for any report callback already in progress. Fixes: c849a6143bec ("HID: Separate struct hid_device's driver_lock into two locks.") Reported-by: syzbot+9eebf5f6544c5e873858@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9eebf5f6544c5e873858 Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Conflicts: drivers/hid/hid-core.c [ 4.19 does not have __hid_device_probe, added in hid_device_probe ] Signed-off-by: Yao Yiqi <yaoyiqi3@huawei.com> --- drivers/hid/hid-core.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index 61b614072e05..8041a90afb7d 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -2097,6 +2097,8 @@ static int hid_device_probe(struct device *dev) ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT); } if (ret) { + if (hdev->io_started) + hid_device_io_stop(hdev); hid_close_report(hdev); hdev->driver = NULL; } -- 2.34.1