Re: [PATCH] HID: logitech-headset: add a battery driver for the PRO X 2

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Incorrect teardown sequence in remove callback violates HID subsystem guidelines.
--

commit adb0241c4db099ec7ce91b1ebd7f292627e20d96
Author: Méven Car <meven29@gmail.com>

HID: logitech-headset: add a battery driver for the PRO X 2

This commit introduces a battery driver for the Logitech PRO X 2 LIGHTSPEED
headset. It communicates with the hardware over a vendor collection using a
polling mechanism scheduled via a delayed work queue to report battery status.

[ ... ]

> diff --git a/drivers/hid/hid-logitech-headset.c b/drivers/hid/hid-logitech-headset.c
> new file mode 100644
> index 0000000000000..9081ddf5f42f2
> --- /dev/null
> +++ b/drivers/hid/hid-logitech-headset.c

[ ... ]

> +static void logi_headset_remove(struct hid_device *hdev)
> +{
> +	struct logi_headset *headset = hid_get_drvdata(hdev);
> +
> +	cancel_delayed_work_sync(&headset->poll);

[Severity: High]
Does this teardown sequence in logi_headset_remove risk a use-after-free?

The HID subsystem guidelines specify that hid_hw_stop must be called before
cancelling asynchronous workers. By executing cancel_delayed_work_sync
before hid_hw_stop, it is theoretically possible for new work to be queued
while the driver is in the process of unbinding. 

Calling hid_hw_stop first ensures that no new events or userspace requests 
can trigger work to be scheduled during resource reclamation.

> +	hid_hw_close(hdev);
> +	hid_hw_stop(hdev);
> +}

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260911115346.17133-1-meven@kde.org?part=1