Re: [PATCH v2 3/4] HID: sony: remove unneeded which argument from sony_schedule_work()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unbalanced `hid_hw_close()` calls lead to `hdev->ll_open_count` underflow.
--

commit 45be0bef88ed1ff7df93b4882f4865bcd24126c9
Author: Rosalie Wanders <rosalie@mailbox.org>

HID: sony: remove unneeded which argument from sony_schedule_work()

The sony_worker enum only had a single member, so removing it simplifies
sony_schedule_work().

> diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
> index aa5e65a13ecbc..9014c1db1ba5c 100644
> --- a/drivers/hid/hid-sony.c
> +++ b/drivers/hid/hid-sony.c
[ ... ]
> @@ -1859,7 +1849,7 @@ static int sony_play_effect(struct input_dev *dev, void *data,
>  	sc->left = effect->u.rumble.strong_magnitude / 256;
>  	sc->right = effect->u.rumble.weak_magnitude / 256;
>  
> -	sony_schedule_work(sc, SONY_WORKER_STATE);
> +	sony_schedule_work(sc);
>  	return 0;
>  }

[Severity: High]
This is a pre-existing issue, but I noticed a potential problem with
unbalanced hid_hw_close() calls leading to an underflow of the open count
in this driver.

In sony_input_configured(), hid_hw_open() is only called if the device
supports battery reporting. However, both the error path in
sony_input_configured() and sony_remove() unconditionally call
hid_hw_close():

drivers/hid/hid-sony.c:sony_input_configured() {
    ...
err_close:
	hid_hw_close(hdev);
    ...
}

drivers/hid/hid-sony.c:sony_remove() {
    ...
	hid_hw_close(hdev);
    ...
}

For devices without battery support (such as motion controllers or
buzz controllers), does this cause an unbalanced close that steals an active
userspace open reference or underflows the open count?

If the force feedback initialization fails for a motion controller over USB,
would the error path execute an unbalanced hid_hw_close() and corrupt the
lifecycle state of the HID device, breaking the low-level driver open and
close state machine?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260616205042.6671-2-rosalie@mailbox.org?part=3