[PATCH] Input: reject inhibit and uninhibit requests on unregistering devices

[Dmitry Torokhov <dmitry.torokhov@gmail.com>]

When an input device is being unregistered via input_unregister_device(),
input_disconnect_device() sets dev->going_away = true under dev->mutex
and releases the mutex.

If a concurrent sysfs write to the inhibited attribute executes
input_inhibit_device() or input_uninhibit_device(), it acquires
dev->mutex. Because neither function checks dev->going_away (unlike
input_open_device()), input_uninhibit_device() proceeds to call
dev->open() and start polling on a device that is in the middle of being
unregistered and torn down.

Fix this by checking dev->going_away in input_inhibit_device() and
input_uninhibit_device() under dev->mutex and returning -ENODEV if the
device is going away.

Fixes: a181616487db ("Input: Add "inhibited" property")
Reported-by: sashiko-bot@kernel.org
Assisted-by: Antigravity:gemini-3.6-flash
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
 drivers/input/input.c | 6 ++++++
 include/linux/input.h | 3 ++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/input/input.c b/drivers/input/input.c
index cf6fecea79b8..dcb1f72711c3 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -1756,6 +1756,9 @@ static int input_inhibit_device(struct input_dev *dev)
 {
 	guard(mutex)(&dev->mutex);
 
+	if (dev->going_away)
+		return -ENODEV;
+
 	if (dev->inhibited)
 		return 0;
 
@@ -1784,6 +1787,9 @@ static int input_uninhibit_device(struct input_dev *dev)
 
 	guard(mutex)(&dev->mutex);
 
+	if (dev->going_away)
+		return -ENODEV;
+
 	if (!dev->inhibited)
 		return 0;
 
diff --git a/include/linux/input.h b/include/linux/input.h
index 76f7aa226202..bb97ebb815bf 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -117,7 +117,8 @@ enum input_clock_type {
  *	user opens device and dev->close() is called when the very
  *	last user closes the device
  * @going_away: marks devices that are in a middle of unregistering and
- *	causes input_open_device*() fail with -ENODEV.
+ *	causes input_open_device() and input_inhibit/uninhibit_device()
+ *	to fail with -ENODEV.
  * @dev: driver model's view of this device
  * @h_list: list of input handles associated with the device. When
  *	accessing the list dev->mutex must be held
-- 
2.55.0.629.g250fe7f194-goog


-- 
Dmitry