[PATCH] HID: roccat: use reader->device instead of re-deriving from devices[]

[Ivy Lopez <skunkolee@gmail.com>]

roccat_release() looked up the device via devices[minor] instead of
using the reader's own reader->device pointer, which was already set
at open() time and is guaranteed to reference the same device the
reader was created against.

This causes two problems on unplug-before-close:

If a device is unplugged while a reader still has it open,
roccat_disconnect() clears devices[minor] to NULL but leaves the
device itself allocated (since device->open is still nonzero at that
point). When the reader is later closed, roccat_release() looks up
devices[minor], finds NULL, and returns -ENODEV immediately, leaking
both the reader and the now-unreachable device without ever running
list_del(), kfree(reader), or decrementing device->open.

If a new device is connected before the old reader is closed, it can
reuse the same minor, so devices[minor] instead points to the new
device by the time the stale reader is released, causing release() to
mutate the wrong device's readers list and open count.

Use reader->device directly, matching the pattern already used by
roccat_read() and roccat_poll() elsewhere in this file, so release()
always operates on the device it was actually opened against.

Fixes: 206f5f2fcb5f ("HID: roccat: propagate special events of roccat hardware to userspace")
Signed-off-by: Ivy Lopez <skunkolee@gmail.com>
---
Thanks to Sashiko AI review for flagging this on the prior patch to
this file.
---
 drivers/hid/hid-roccat.c | 13 +------------
 1 file changed, 1 insertion(+), 12 deletions(-)

diff --git a/drivers/hid/hid-roccat.c b/drivers/hid/hid-roccat.c
index 53358297e96c..bbaa782fb7da 100644
--- a/drivers/hid/hid-roccat.c
+++ b/drivers/hid/hid-roccat.c
@@ -202,19 +202,10 @@ static int roccat_open(struct inode *inode, struct file *file)
 
 static int roccat_release(struct inode *inode, struct file *file)
 {
-	unsigned int minor = iminor(inode);
 	struct roccat_reader *reader = file->private_data;
-	struct roccat_device *device;
+	struct roccat_device *device = reader->device;
 
 	mutex_lock(&devices_lock);
-
-	device = devices[minor];
-	if (!device) {
-		mutex_unlock(&devices_lock);
-		pr_emerg("roccat device with minor %d doesn't exist\n", minor);
-		return -ENODEV;
-	}
-
 	mutex_lock(&device->readers_lock);
 	list_del(&reader->node);
 	mutex_unlock(&device->readers_lock);
@@ -229,9 +220,7 @@ static int roccat_release(struct inode *inode, struct file *file)
 			kfree(device);
 		}
 	}
-
 	mutex_unlock(&devices_lock);
-
 	return 0;
 }
 
-- 
2.55.0