[PATCH] HID: microsoft: cancel ff_worker on remove to avoid use-after-free

[PATCH] HID: microsoft: cancel ff_worker on remove to avoid use-after-free

[hyunjungg]

From: Hyunjung Ko <hj351016@gmail.com>

ms_play_effect() schedules ms->ff_worker to send the force-feedback
report. ms is devm-allocated, so it is freed only after ms_remove()
returns. Commit 1cfc77a64b71 ("HID: microsoft: move FF initialization
to .input_configured()") dropped the cancel_work_sync(&ms->ff_worker)
call that the remove path previously had, so an ff_worker scheduled just
before the device goes away can still run after ms (and ms->hdev,
ms->output_report_dmabuf) has been freed -- a use-after-free.

Cancel ff_worker before hid_hw_stop() in ms_remove(), restoring the
teardown the driver had before the FF-init rework (and matching
hid-bigbenff). cancel_work_sync() is safe even if ff_worker was never
initialized: ms is zero-allocated, so the work reads as idle.

Fixes: 1cfc77a64b71 ("HID: microsoft: move FF initialization to .input_configured()")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunjung Ko <hj351016@gmail.com>
---
 drivers/hid/hid-microsoft.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/hid-microsoft.c b/drivers/hid/hid-microsoft.c
index a7d3493..462fdaf 100644
--- a/drivers/hid/hid-microsoft.c
+++ b/drivers/hid/hid-microsoft.c
@@ -384,6 +384,9 @@ static int ms_probe(struct hid_device *hdev, const struct hid_device_id *id)
 }
 static void ms_remove(struct hid_device *hdev)
 {
+	struct ms_data *ms = hid_get_drvdata(hdev);
+
+	cancel_work_sync(&ms->ff_worker);
 	hid_hw_stop(hdev);
 }
 
-- 
2.43.0