From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BAB6133F59C; Tue, 13 Oct 2026 09:12:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791882773; cv=none; b=HBrpzbT6CGCEBsFEZ9nGROuqGFktQkKL/Rk/8uSeg+YYyAeAlfRLyF913DhCn/fIyDyD0jlfq2KdE5Tb0j+8fqDi4s0QCIz7LGP6nL/5SWV8mDddwU+9newXtxjHf3Tng7j6ghE3YpsNRIgMPBq3lXDYj1sb1/+egoTfMid4FxA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791882773; c=relaxed/simple; bh=dXssZh07vJMDpSMqwEZqpjTMP3R2Z2flK5Tzc/DqKF0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=smhq+83FBhrCh9wjRWcZIQsoBY9r2aZlfdFUDrGhFva6l2pkG6LtBIAnEuMV3CFjgwIDhCVkRRLuixyUV9cBTbER/UXOF/Yt99dmkpe65R/9FmTX1O72EAZn9p7e1cs/zft14tMjmrNpAevaufC1Z1d54pzlldiUshcxzV85/s8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=QKDKgOhX; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="QKDKgOhX" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3B3A81F00899; Tue, 13 Oct 2026 09:12:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1791882771; bh=Jjya3k/Vj1CbSCqnYl95YQIUgdoL4SO+7EvpsBHpjnw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=QKDKgOhX+QHWomH93e5skSJGrbmelzXwBTqmFQUUbRb64A4nMb75b88aITGxboGEF nLffdEYsX0vOVTRD+JQUCyFb3aoM0mVthC6a/R9eQjurQWqHn4IKImDBj0rjkkHMaS +TVz9w6ml9Pv46JHRbPn/suyKb6w1zNAmv00tCLnazK8zeTRuYwjJtE9BLBeQM4VlO PlbIwWUQaBqzFCG9C7Jdzas1GkFqFssyu5wwX2O4g5lLkEWVRQT24eMr4JD/lpCjK4 JoWC2rZpgqh4Eugk6SZUdLtBJxOUXQ1gfqXDU7n4FYNxTwuC3ln/VXJQ3+nbGtMPLJ WkCO6CYJ7wAzw== From: Lee Jones To: lee@kernel.org, Jiri Kosina , Benjamin Tissoires , linux-input@vger.kernel.org, linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org, Vicki Pfau , Jiri Kosina Subject: [STABLE v6.6 3/5] HID: steam: Rearrange teardown sequence Date: Tue, 13 Oct 2026 09:11:52 +0000 Message-ID: <20261013091156.528734-3-lee@kernel.org> X-Mailer: git-send-email 2.56.0.385.gd3acb90ef8-goog In-Reply-To: <20261013091156.528734-1-lee@kernel.org> References: <20261013091156.528734-1-lee@kernel.org> Precedence: bulk X-Mailing-List: linux-input@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Vicki Pfau [ Upstream commit ddce9641ce924ed91ec8304577e463823a29ffaf ] This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that would then have a dangling pointer to the now-freed steam struct. This also puts work canceling for rumble and mode switch in steam_unregister, as that shouldn't persist while the client hdev is open. Signed-off-by: Vicki Pfau Signed-off-by: Jiri Kosina [Lee: Omit coalesce_rumble_work cancellation as 1d4549fd1115 ("HID: steam: Coalesce rumble packets") is not present] Signed-off-by: Lee Jones --- drivers/hid/hid-steam.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c index 59e39bdf34ed..df176a722061 100644 --- a/drivers/hid/hid-steam.c +++ b/drivers/hid/hid-steam.c @@ -1020,6 +1020,8 @@ static void steam_unregister(struct steam_device *steam) steam_battery_unregister(steam); steam_sensors_unregister(steam); steam_input_unregister(steam); + cancel_work_sync(&steam->rumble_work); + cancel_delayed_work_sync(&steam->mode_switch); mutex_lock(&steam_devices_lock); list_del_init(&steam->list); mutex_unlock(&steam_devices_lock); @@ -1301,24 +1303,24 @@ static int steam_probe(struct hid_device *hdev, static void steam_remove(struct hid_device *hdev) { struct steam_device *steam = hid_get_drvdata(hdev); + unsigned long flags; if (!steam || hdev->group == HID_GROUP_STEAM) { hid_hw_stop(hdev); return; } + hid_hw_close(hdev); hid_destroy_device(steam->client_hdev); - cancel_delayed_work_sync(&steam->mode_switch); - cancel_work_sync(&steam->work_connect); - cancel_work_sync(&steam->rumble_work); - steam->client_hdev = NULL; + spin_lock_irqsave(&steam->lock, flags); steam->client_opened = 0; + spin_unlock_irqrestore(&steam->lock, flags); + cancel_work_sync(&steam->work_connect); if (steam->quirks & STEAM_QUIRK_WIRELESS) { hid_info(hdev, "Steam wireless receiver disconnected"); } - hid_hw_close(hdev); - hid_hw_stop(hdev); steam_unregister(steam); + hid_hw_stop(hdev); } static void steam_do_connect_event(struct steam_device *steam, bool connected) -- 2.56.0.385.gd3acb90ef8-goog