Input: reject inhibit and uninhibit requests on unregistering devices

When an input device is being unregistered via input_unregister_device(),
input_disconnect_device() sets dev->going_away = true under dev->mutex
and releases the mutex.

If a concurrent sysfs write to the inhibited attribute executes
input_inhibit_device() or input_uninhibit_device(), it acquires
dev->mutex. Because neither function checks dev->going_away (unlike
input_open_device()), input_uninhibit_device() proceeds to call
dev->open() and start polling on a device that is in the middle of being
unregistered and torn down.

Fix this by checking dev->going_away in input_inhibit_device() and
input_uninhibit_device() under dev->mutex and returning -ENODEV if the
device is going away.

Fixes: a181616487db ("Input: Add "inhibited" property")
Reported-by: sashiko-bot@kernel.org
Assisted-by: Antigravity:gemini-3.6-flash
Link: https://patch.msgid.link/anEolqA35rGei9ql@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

drivers/input/input.c

diff --git a/drivers/input/input.c b/drivers/input/input.c
index c9f4806..78c10ee 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -1788,6 +1788,9 @@ static int input_inhibit_device(struct input_dev *dev)
 {
 	guard(mutex)(&dev->mutex);
 
+	if (dev->going_away)
+		return -ENODEV;
+
 	if (dev->inhibited)
 		return 0;
 
@@ -1821,6 +1824,9 @@ static int input_uninhibit_device(struct input_dev *dev)
 
 	guard(mutex)(&dev->mutex);
 
+	if (dev->going_away)
+		return -ENODEV;
+
 	if (!dev->inhibited)
 		return 0;
 

include/linux/input.h

diff --git a/include/linux/input.h b/include/linux/input.h
index 0ee5f32..3381608 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -117,7 +117,8 @@ enum input_clock_type {
  *	user opens device and dev->close() is called when the very
  *	last user closes the device
  * @going_away: marks devices that are in a middle of unregistering and
- *	causes input_open_device*() fail with -ENODEV.
+ *	causes input_open_device() and input_inhibit/uninhibit_device()
+ *	to fail with -ENODEV.
  * @dev: driver model's view of this device
  * @h_list: list of input handles associated with the device. When
  *	accessing the list dev->mutex must be held