Hello,

updating our codebase to v6.8-rc4 which contains:

eb988e46da2e Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()

I noticed that the previously noticed crash in the rmi4 was present again.

Previously, we were using a fix from the grsecurity codebase which changed the function in the following way:

void rmi_unregister_function(struct rmi_function *fn)
{
	int i;

	rmi_dbg(RMI_DEBUG_CORE, &fn->dev, "Unregistering F%02X.\n",
			fn->fd.function_number);

	for (i = 0; i < fn->num_of_irqs; i++)
		irq_dispose_mapping(fn->irq[i]);

	device_del(&fn->dev);
	of_node_put(fn->dev.of_node);
	put_device(&fn->dev);
}

With this version of the fix the crash didn't happen. Please note, that the crash happens in device_del which is before the irq_dispose_mapping call in eb988e46da2e.

Attached is a kernel log from the crash with a kernel based on v6.8-rc4.

Thanks,

	Torsten