Re: [PATCH v3] HID: ayaneo: Add AYANEO 3 detachable controller driver

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] hid: ayaneo: data race on completion state in ayaneo_cmd()
--

commit c219d53cacc831077bc77b38a3e4bceead638885
Author: Matías Martínez <hello@matias.me>
HID: ayaneo: Add AYANEO 3 detachable controller driver

This commit adds a HID driver for the AYANEO 3 detachable controller's
vendor interface. It provides support for module identification, software
eject, and RGB control of the joystick rings via the multicolor LED class.
The driver communicates with the device using a custom 65-byte command
protocol.

> diff --git a/drivers/hid/hid-ayaneo.c b/drivers/hid/hid-ayaneo.c
> new file mode 100644
> index 0000000000000..3a7af5918ee1e
> --- /dev/null
> +++ b/drivers/hid/hid-ayaneo.c

[ ... ]

> +static int ayaneo_cmd(struct ayaneo *aya, struct aya3_resp *resp)
> +{
> +	int attempt, ret;
> +
> +	lockdep_assert_held(&aya->lock);
> +
> +	for (attempt = 0; attempt < AYA3_CMD_ATTEMPTS; attempt++) {
> +		reinit_completion(&aya->resp_done);

[Severity: Medium]
Could this trigger a data race if a late hardware response arrives right as
the loop restarts?

If wait_for_completion_timeout() times out, the code loops back and calls
reinit_completion() while aya->resp_pending is still true. If the hardware
sends a late reply at this exact moment, ayaneo_raw_event() can read
aya->resp_pending as true and call complete() concurrently.

Since reinit_completion() modifies the completion locklessly while complete()
modifies it under a lock, this could corrupt the completion state and lead
to lost or phantom wakeups. Should aya->resp_pending be cleared before
reinitializing the completion, or perhaps cleared at the end of the timeout
path?

> +		aya->resp_expect = aya->xfer[4];
> +		WRITE_ONCE(aya->resp_pending, true);
> +
> +		ret = ayaneo_send(aya);
> +		if (ret) {
> +			WRITE_ONCE(aya->resp_pending, false);
> +			return ret;
> +		}
> +
> +		if (wait_for_completion_timeout(&aya->resp_done,
> +						msecs_to_jiffies(AYA3_CMD_TIMEOUT_MS))) {
> +			if (resp)
> +				memcpy(resp, &aya->resp, sizeof(*resp));
> +			return 0;
> +		}
> +	}
> +	WRITE_ONCE(aya->resp_pending, false);
> +	return -ETIMEDOUT;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917160722.89391-1-hello@matias.me?part=1