[PATCH] HID: magicmouse: disable the multitouch work on removal

[PATCH] HID: magicmouse: disable the multitouch work on removal

[Myeonghun Pak]

During USB runtime reset-resume, usbhid can call magicmouse_reset_resume()
without serialization against HID driver unbind. The USB interface
remains bound to usbhid, so this callback can queue msc->work after
magicmouse_remove() cancels it. The delayed work can then run after
devres frees msc.

Use disable_delayed_work_sync() to drain the work and reject later
queueing. Probe initializes fresh work on rebind.

Found by a static analysis tool under development.

Fixes: 4253fe22b137 ("HID: magicmouse: re-enable multitouch after reset-resume")
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>

---

diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
index a01e84a18ded..525ffc64a2f0 100644
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -1032,7 +1032,7 @@ static void magicmouse_remove(struct hid_device *hdev)
 	struct magicmouse_sc *msc = hid_get_drvdata(hdev);
 
 	if (msc) {
-		cancel_delayed_work_sync(&msc->work);
+		disable_delayed_work_sync(&msc->work);
 		if (is_usb_magicmouse2(hdev->vendor, hdev->product) ||
 		    is_usb_magictrackpad2(hdev->vendor, hdev->product))
 			timer_delete_sync(&msc->battery_timer);

base-commit: 630059a5a632377b9b7b487baccde92b7ae1dd47
-- 
2.43.0