> --- a/drivers/input/evdev.c
quoted text
> +++ b/drivers/input/evdev.c
> @@ -853,6 +853,9 @@ static void evdev_cleanup(struct evdev *evdev)
>  	evdev_hangup(evdev);
>  	evdev_remove_chrdev(evdev);
> =20
> +	if (evdev->grab)
> +		evdev_ungrab(evdev, evdev->grab);
> +

You might want to insert a comment about why this is safe and doesn't
race since it's not entirely trivial to see because everything else that
manipulates the grab needs to take the mutex. In fact, I'm not entirely
sure it's race-free but at least it can't race against the ioctl handler
because by this time ->exist will be 0.

johannes