Re: [PATCH v2 2/5] HID: UNCTRL: add basic battery reporting for UNCTRL RAGE Mouse

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] hid: unbalanced hid_hw_close() in unctrl_remove() for non-vendor interfaces
--

commit 34f6450fbc06f0259d8e3dc8b22b5c1567b8c302
Author: Bishwa Bhusan Saha <contact@bishwasaha.com>
HID: UNCTRL: add basic battery reporting for UNCTRL RAGE Mouse

This initial patch will probe the battery only once. A later patch
will add periodic checking.

> diff --git a/drivers/hid/hid-unctrl-m1.c b/drivers/hid/hid-unctrl-m1.c
> new file mode 100644
> index 0000000000000..3896468adf77f
> --- /dev/null
> +++ b/drivers/hid/hid-unctrl-m1.c
[ ... ]
> +static int unctrl_probe(struct hid_device *hdev, const struct hid_device_id *id)
> +{
[ ... ]
> +	ret = hid_hw_start(hdev, connect_mask);
> +	if (ret) {
> +		hid_err(hdev, "%s:hw start failed with error %d\n", __func__,
> +			ret);
> +		return ret;
> +	}
> +
> +	if (!vendor)
> +		return 0;
> +
> +	dev = kzalloc_obj(*dev);
[ ... ]
> +	/* usbhid polls the interrupt in endpoint only while it is open */
> +	ret = hid_hw_open(hdev);
[ ... ]
> +static void unctrl_remove(struct hid_device *hdev)
> +{
> +	struct unctrl_dev *dev = hid_get_drvdata(hdev);
> +
> +	hid_hw_close(hdev);

[Severity: High]
Does this code cause a hardware reference count underflow for non-vendor
interfaces?

When the driver binds to a non-vendor interface, unctrl_probe() correctly
returns 0 early without calling hid_hw_open() or allocating the private
dev struct. However, upon driver unbind, unctrl_remove() unconditionally
calls hid_hw_close() before checking if dev is NULL.

Any hot-unplug, module unload, or manual driver unbind of a non-vendor
interface will trigger this unbalanced close, underflowing the
hdev->ll_open_count. This corrupts the transport open state and prevents
the device from being properly opened subsequently (e.g., by hidraw or
hidinput).

> +
> +	hid_hw_stop(hdev);
> +
> +	if (!dev)
> +		return;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013-b4-unctrl-m1-battery-v2-0-bd6752021753@bishwasaha.com?part=2