Re: [PATCH v2 1/2] HID: wacom: Fix Use-After-Free in wacom_intuos_pad

From: Markus Elfring

Date: Mon Jun 01 2026 - 10:53:12 EST



> +++ b/drivers/hid/wacom_sys.c
> @@ -877,10 +877,16 @@ static void wacom_remove_shared_data(void *res)
> data = container_of(wacom_wac->shared, struct wacom_hdev_data,
> shared);
>
> - if (wacom_wac->shared->touch == wacom->hdev)
> + mutex_lock(&wacom_udev_list_lock);
> + if (wacom_wac->shared->touch == wacom->hdev) {
> wacom_wac->shared->touch = NULL;

> + }
> + mutex_unlock(&wacom_udev_list_lock);
> +
> + synchronize_rcu();
>
> kref_put(&data->kref, wacom_release_shared_data);


Under which circumstances would you dare to apply another lock guard?
https://elixir.bootlin.com/linux/v7.1-rc5/source/include/linux/mutex.h#L253

Regards,
Markus