github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

HID: mcp2221: always initialize and cancel init_work

Browse Source 
The writable gpio_mode_enforce parameter can change between probe and
remove.

If it changes from false to true after probe, remove skips cancellation
of init_work. Pending or running work can then access devm-managed
driver state after teardown. Changing it from true to false can make
remove cancel an uninitialized delayed work item.

Initialize init_work whenever IIO is reachable and cancel it
unconditionally on remove. Keep the parameter check only for scheduling
the initialization.

The false-to-true cancellation gap was previously reported by Sashiko.
We also encountered this issue during our static-analysis research.

Fixes: 200e6c6e94 ("HID: mcp2221: Add module parameter to enfoce GPIO mode")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/linux-input/20260715143415.916A21F00A3A@smtp.kernel.org/
Assisted-by: LLM
Cc: stable@vger.kernel.org
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
This commit is contained in:
Myeonghun Pak 2026-10-02 17:44:16 -04:00 committed by Jiri Kosina
parent 5b66b65cfd
commit 6a006ff898
1 changed files with 3 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/hid/hid-mcp2221.c
View File

@ -1072,8 +1072,7 @@ static void mcp2221_remove(struct hid_device *hdev)
#if IS_REACHABLE(CONFIG_IIO)
struct mcp2221 *mcp = hid_get_drvdata(hdev);
if (!gpio_mode_enforce)
cancel_delayed_work_sync(&mcp->init_work);
cancel_delayed_work_sync(&mcp->init_work);
#endif
}
@ -1347,10 +1346,9 @@ static int mcp2221_probe(struct hid_device *hdev,
#endif
#if IS_REACHABLE(CONFIG_IIO)
if (!gpio_mode_enforce) {
INIT_DELAYED_WORK(&mcp->init_work, mcp_init_work);
INIT_DELAYED_WORK(&mcp->init_work, mcp_init_work);
if (!gpio_mode_enforce)
schedule_delayed_work(&mcp->init_work, msecs_to_jiffies(100));
}
#endif
return 0;