Re: [PATCH] HID: mcp2221: stop device IO before hid_hw_stop

On Tue, 28 Jul 2026, Jiangshan Yi wrote:

mcp2221_probe() calls hid_device_io_start() to allow synchronous HID
transactions during setup.  If probe fails afterwards, the devm cleanup
callback mcp2221_hid_unregister() calls hid_hw_close()/hid_hw_stop()
without first calling hid_device_io_stop().

hid_hw_stop() does not stop device IO, so hid_input_report() may still
be delivered and access driver data being freed, causing a
use-after-free.  The same window exists on normal device removal.

Call hid_device_io_stop() at the top of mcp2221_hid_unregister() so
that IO is quiesced before the hardware is stopped in both the error
and remove paths.

Applied, thanks.

-- 
Jiri Kosina
SUSE Labs