From: Myeonghun Pak <mhun512@gmail.com>
To: Jiri Kosina <jikos@kernel.org>, Benjamin Tissoires <bentiss@kernel.org>
Cc: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org,
Ijae Kim <ae878000@gmail.com>
Subject: [PATCH] HID: magicmouse: disable the multitouch work on removal
Date: Mon, 9 Nov 2026 23:30:01 -0500 [thread overview]
Message-ID: <20261110043001.56615-1-mhun512@gmail.com> (raw)
During USB runtime reset-resume, usbhid can call magicmouse_reset_resume()
without serialization against HID driver unbind. The USB interface
remains bound to usbhid, so this callback can queue msc->work after
magicmouse_remove() cancels it. The delayed work can then run after
devres frees msc.
Use disable_delayed_work_sync() to drain the work and reject later
queueing. Probe initializes fresh work on rebind.
Found by a static analysis tool under development.
Fixes: 4253fe22b137 ("HID: magicmouse: re-enable multitouch after reset-resume")
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
index a01e84a18ded..525ffc64a2f0 100644
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -1032,7 +1032,7 @@ static void magicmouse_remove(struct hid_device *hdev)
struct magicmouse_sc *msc = hid_get_drvdata(hdev);
if (msc) {
- cancel_delayed_work_sync(&msc->work);
+ disable_delayed_work_sync(&msc->work);
if (is_usb_magicmouse2(hdev->vendor, hdev->product) ||
is_usb_magictrackpad2(hdev->vendor, hdev->product))
timer_delete_sync(&msc->battery_timer);
base-commit: 630059a5a632377b9b7b487baccde92b7ae1dd47
--
2.43.0
reply other threads:[~2026-11-10 4:30 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261110043001.56615-1-mhun512@gmail.com \
--to=mhun512@gmail.com \
--cc=ae878000@gmail.com \
--cc=bentiss@kernel.org \
--cc=jikos@kernel.org \
--cc=linux-input@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®