[PATCH] HID: roccat: fix device lifetime during disconnect

[Hongyan Xu <getshell@seu.edu.cn>]

roccat_disconnect() drops devices_lock after loading the device pointer. A
concurrent release of the last reader can then free the device before
disconnect continues to access it. Release also looks the device up by
minor, so closing a file after disconnect either leaks its reader when the
slot is NULL or operates on a replacement device if the minor was reused.

Keep devices_lock held while disconnect marks and removes the device, and
have release use the device retained by its reader. The open count then
keeps a disconnected device alive until the final file is released.

Fixes: 206f5f2fcb5f ("HID: roccat: propagate special events of roccat hardware to userspace")
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
---
 drivers/hid/hid-roccat.c | 15 +++------------
 1 file changed, 3 insertions(+), 12 deletions(-)

diff --git a/drivers/hid/hid-roccat.c b/drivers/hid/hid-roccat.c
index d6fff53d4ee7..4f504e7575e8 100644
--- a/drivers/hid/hid-roccat.c
+++ b/drivers/hid/hid-roccat.c
@@ -202,19 +202,11 @@ static int roccat_open(struct inode *inode, struct file *file)
 
 static int roccat_release(struct inode *inode, struct file *file)
 {
-	unsigned int minor = iminor(inode);
 	struct roccat_reader *reader = file->private_data;
-	struct roccat_device *device;
+	struct roccat_device *device = reader->device;
 
 	mutex_lock(&devices_lock);
 
-	device = devices[minor];
-	if (!device) {
-		mutex_unlock(&devices_lock);
-		pr_emerg("roccat device with minor %d doesn't exist\n", minor);
-		return -ENODEV;
-	}
-
 	mutex_lock(&device->readers_lock);
 	list_del(&reader->node);
 	mutex_unlock(&device->readers_lock);
@@ -360,15 +352,12 @@ void roccat_disconnect(int minor)
 
 	mutex_lock(&devices_lock);
 	device = devices[minor];
-	mutex_unlock(&devices_lock);
 
 	device->exist = 0; /* TODO exist maybe not needed */
 
 	device_destroy(device->dev->class, MKDEV(roccat_major, minor));
 
-	mutex_lock(&devices_lock);
 	devices[minor] = NULL;
-	mutex_unlock(&devices_lock);
 
 	if (device->open) {
 		hid_hw_close(device->hid);
@@ -376,6 +365,8 @@ void roccat_disconnect(int minor)
 	} else {
 		kfree(device);
 	}
+
+	mutex_unlock(&devices_lock);
 }
 EXPORT_SYMBOL_GPL(roccat_disconnect);
 
-- 
2.50.1.windows.1