[PATCH 00/21] HID: fix racy force feedback initialization via .input_configured()

[Dmitry Torokhov <dmitry.torokhov@gmail.com>]

When a HID driver calls hid_hw_start() with the HID_CONNECT_HIDINPUT
flag (included in HID_CONNECT_DEFAULT), the HID core immediately registers
the input device with the input subsystem, making it live and accessible to
userspace.

Historically, many HID drivers initialized force-feedback capabilities (via
input_ff_create_memless() or custom workqueues) in their probe() callback
after calling hid_hw_start(). This introduces a window where userspace can
open the input node and trigger force-feedback ioctls before the driver has
finished preparing its private structures or workqueues, leading to potential
NULL pointer dereferences and race conditions.

To eliminate this anti-pattern across the subsystem, this series:
- Enhances the HID core to automatically handle driver force-feedback
  initialization during input device registration.
- Refactors individual HID drivers to perform all force-feedback setup
  inside the .input_configured() callback, ensuring the input device is
  fully prepared before it is exposed to userspace.
- Adds documentation and a Coccinelle script to prevent future regressions.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
Dmitry Torokhov (21):
      HID: core: automatically initialize generic FF if no other FF is present
      HID: add documentation and Coccinelle script for FF registration race
      HID: axff: move FF initialization to .input_configured()
      HID: betop: move FF initialization to .input_configured()
      HID: bigben: move FF initialization to .input_configured()
      HID: dragonrise: move FF initialization to .input_configured()
      HID: emsff: move FF initialization to .input_configured()
      HID: gaff: move FF initialization to .input_configured()
      HID: stadia: use open/close to manage workqueue lifecycle
      HID: stadia: move FF initialization to .input_configured()
      HID: holtek: move FF initialization to .input_configured()
      HID: move generic FF initialization into hidinput_connect()
      HID: microsoft: move FF initialization to .input_configured()
      HID: pantherlord: move FF initialization to .input_configured()
      HID: thrustmaster: move FF initialization to .input_configured()
      HID: zeroplus: move FF initialization to .input_configured()
      HID: mayflash: move FF initialization to .input_configured()
      HID: smartjoyplus: move FF initialization to .input_configured()
      HID: megaworld: move FF initialization to .input_configured()
      HID: logitech-hidpp: move FF initialization to .input_configured()
      HID: haptic: move FF initialization into .input_configured()

 Documentation/hid/hidintro.rst       |  50 ++++++++++++
 drivers/hid/hid-axff.c               |  40 +++-------
 drivers/hid/hid-betopff.c            |  33 +++-----
 drivers/hid/hid-bigbenff.c           |  89 ++++++++++-----------
 drivers/hid/hid-core.c               |   8 +-
 drivers/hid/hid-dr.c                 |  66 ++++-----------
 drivers/hid/hid-emsff.c              |  50 ++----------
 drivers/hid/hid-gaff.c               |  53 +++----------
 drivers/hid/hid-google-stadiaff.c    | 112 ++++++++++----------------
 drivers/hid/hid-haptic.c             |  45 ++++-------
 drivers/hid/hid-haptic.h             |   6 +-
 drivers/hid/hid-holtekff.c           |  46 +++--------
 drivers/hid/hid-input.c              |  21 ++++-
 drivers/hid/hid-logitech-hidpp.c     |  36 +++++----
 drivers/hid/hid-megaworld.c          |  51 +++---------
 drivers/hid/hid-mf.c                 |  77 +++++++-----------
 drivers/hid/hid-microsoft.c          |  38 ++-------
 drivers/hid/hid-multitouch.c         |  10 +--
 drivers/hid/hid-pl.c                 | 150 +++++++++++++++--------------------
 drivers/hid/hid-sjoy.c               |  83 ++++++++-----------
 drivers/hid/hid-tmff.c               |  47 ++++-------
 drivers/hid/hid-zpff.c               |  43 ++--------
 include/linux/hid.h                  |   2 +-
 scripts/coccinelle/hid/ff_race.cocci |  34 ++++++++
 24 files changed, 465 insertions(+), 725 deletions(-)
---
base-commit: 415606a7be939835db9b0d6b711887586646346d
change-id: 20260802-hid-ff-input-configured-397bc1503256

Thanks.

-- 
Dmitry