From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ed1-f47.google.com (mail-ed1-f47.google.com [209.85.208.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 294123FC5DD for ; Mon, 24 Aug 2026 17:37:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787593053; cv=none; b=dZvnfQ3D4zmxsg6RCiS8UPeE0dsag9WX/3/fk3pb5dJ6edYPYk1rnR9Yc9hwrISaNLVKykEMnvHqVtoWOOJQKLxA/YnS2qscpa3lQpvZCilvMVbKjbsWVCcTVsn+VsrMTYiHbiptGW4KUPcpEdQYY62K6AAClJVaaTvvRBIXhss= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787593053; c=relaxed/simple; bh=iXOhgnPLmwpFGKlA/HthfKQsOb2m2ZTvoRHdiAfQ6Zk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=j/FMUNdjFNu3xRRC/8xkpBLUhd01Wmh0dDhquf6ExsthsR4uftsNLP+7Ql7NnwzQNLS0mEvJxdDeddBuJkT/hvie6rK8Idhw98t3utXpOt+FSqHFsK8TUR/k0bptxl44zGm6cNHDiXZb+GlrtGj10bv/Y4V7UHXMDekDSCkZMqE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=BQU5SJR8; arc=none smtp.client-ip=209.85.208.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="BQU5SJR8" Received: by mail-ed1-f47.google.com with SMTP id 4fb4d7f45d1cf-6a374bea882so7165787a12.1 for ; Mon, 24 Aug 2026 10:37:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787593044; x=1788197844; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=N8DPaTwYfYl5EcD9GcdAo2GOI2V8KsaETPVZPUOF+EE=; b=BQU5SJR8wyhVViMs1tCw7KtNw4bZYXrTT/fMg78WkCsVb+0G82zKKYHzSpV3fsCqwy S6bECrNQqCOtmygiVkfhOEoXP2sC69X29iykDRP92NGHM/1tNGunBtu2DqSs6Om8loSt yuo1TIO//QtYWtyua4Kg70ej3EAs6WfMgWzhrTxeP6Woxe2HH1n2n8Woo6gj+D9iLeT+ fFatXPtL0PaaCZX8Lg4FTVrvcmuyennUqjjVC+s1Vo9/aWX3tDPSPmVAGTOAvZiMy5BC D91mUnzueibxAT4DlYLMoBEl0EDVt9Cf7LzMrk5IjTXBVxrk5W2YthHnSsQGN+M7SZz0 6Liw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787593044; x=1788197844; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=N8DPaTwYfYl5EcD9GcdAo2GOI2V8KsaETPVZPUOF+EE=; b=SGVXQx2ga6kgpM3/PfpphVPaHnzGGitWwNSaXvkN26eRDEEW81EJ0KWHm+9EaVzhk8 8qoZpTUFZWLhkHR1PPLSt7bgdoDpFnogBRAObv9L6CHF2wF8F3kWVlvl8cBgHHMvy0Mp EZmpGKSWfCbIGLN1wIZhuKBtJN2nkldFPwOmRQuHgi6KwrWqEpZApWcEuyWKyLnByalZ m/w2XEjcLJM2sXxqI4EBnD6SlszhLHdyFWPFKhodZhs+FJWrmmRZRKu4i/p0KXCNDmWA +p65GnZqmARLzCuhnQdkWX0aXuCau5HM7mvpjQ7BvVWnCO4d106Gw2rkerfW1ShKZDAJ mVyg== X-Forwarded-Encrypted: i=1; AHgh+Rr9ez+DZ9epL4/4hvO+zHH3dB8M7vos+teRHiIDOhOIb0CsxTPseWoJ6YvqWzVhKi5/zKpXRiNo8dy/6CY=@vger.kernel.org X-Gm-Message-State: AFuF++n6JgZDBPEB/Lwpf0ZRVPFL1eXlYnPdLzKShS4+uLOoOXHmBTJ4 +6dFaKlC6c5cOOHfRQqhp7t+eNk6qr3AsGPM5phqcbWXuK0CY5ioeU6C X-Gm-Gg: AR+sD129eKRPKcA4LQQj+6rF1N/uYTdKmUzCMhxCpP42pUOdlcoLGaA6AtwHCP960xi T5OHQkA3sWP0LVdMfx38Q/oSBtxH/gF23Tv8YoK2TJuO8taZMctG67l0qj5pIUwP8Ugz8Z4oGXi bn4LoN8tBbaqyc4QPYP+6tzcEwVhU/xyj0aOCjzgFZcl8OUqf1MDOvWCDLOpZLAfZ0pPfliblPD qT+1GVrgX/Lfs/cMqeJGZctLgyPzGR0m5+4SvdLsx/qYOYdseScP32BmRij+REM6XmzmGJHYhMF 3IYyv7qPzjD2CyAk/tBL+iWNVMxOtOH89MqW2DYvICZDHPqRrNhkECfkFank1XHeEF2fjzgFTPG limSwaQ6mZb4rOeGt2Yb7GMItRFd+VN9PhZr/yKITm9GxeQKIklP995MqsLfTF5tOSyxefuZjmt s4OPXfL8gIh4rdtQdXwMKnwgbayLLmb+j35utNmq9XCPMmerLt1FNGb3wqc8QJIFZHvKz/42z+0 xubGmsCAtDXiTiJQuqCSsnrlkzIGPakz+wrKkbwXG3GUoKLKlnDPo/UfzaydZUIKvy43R8= X-Received: by 2002:a05:6402:1906:b0:6a1:f8ad:6c0c with SMTP id 4fb4d7f45d1cf-6a42f1fce20mr34626689a12.16.1787593043662; Mon, 24 Aug 2026 10:37:23 -0700 (PDT) Received: from dmig-l13.lan ([94.139.29.227]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-6a59e0190d3sm9361057a12.9.2026.08.24.10.37.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 24 Aug 2026 10:37:22 -0700 (PDT) From: Dmitriy Geels To: =?UTF-8?q?Filipe=20La=C3=ADns?= , Bastien Nocera Cc: Jiri Kosina , Benjamin Tissoires , Stuart Hayhurst , linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, Dmitriy Geels Subject: [PATCH] HID: logitech-hidpp: cancel reset_hi_res_work on probe failure Date: Mon, 24 Aug 2026 19:37:18 +0200 Message-ID: <20260824173718.14687-1-dmitriy.geels@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The probe error path cancels hidpp->work before freeing the HID++ device data, but does not cancel reset_hi_res_work. reset_hi_res_work can be scheduled while probing the device. If probe subsequently fails, the work can run after the driver data has been freed. Cancel reset_hi_res_work in the probe error path to prevent a potential use-after-free. Fixes: ed80cc4667ac ("HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL") Signed-off-by: Dmitriy Geels --- This patch is a result of Sashiko AI review for "HID: logitech-hidpp: add native touchpad support for K400 Plus": - [High] Missing cancel_work_sync for reset_hi_res_work in the probe error path leads to a Use-After-Free. drivers/hid/hid-logitech-hidpp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c index 9a6b04283130..279384fa9835 100644 --- a/drivers/hid/hid-logitech-hidpp.c +++ b/drivers/hid/hid-logitech-hidpp.c @@ -4925,6 +4925,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id) hid_hw_start_fail: sysfs_remove_group(&hdev->dev.kobj, &ps_attribute_group); cancel_work_sync(&hidpp->work); + cancel_work_sync(&hidpp->reset_hi_res_work); mutex_destroy(&hidpp->send_mutex); return ret; } -- 2.55.0