[PATCH] HID: logitech-hidpp: cancel reset_hi_res_work on probe failure

[Guangshuo Li <lgs201920130244@gmail.com>]

hidpp_probe() initializes reset_hi_res_work before starting the device.
Once device I/O is started, incoming HID++ events may schedule this work.

If a later probe step fails, the error path stops the hardware and
cancels hidpp->work, but leaves reset_hi_res_work pending. Since hidpp
is devm allocated, it may be freed after probe returns while the work
is still queued, potentially resulting in a use-after-free when the
work handler runs.

Cancel reset_hi_res_work in the probe error path, matching the cleanup
performed by hidpp_remove().

This issue was found by manual code inspection.

Fixes: ed80cc4667ac ("HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/hid/hid-logitech-hidpp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 1504de32b1c8..6a21b281a1df 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -4834,6 +4834,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
 hid_hw_start_fail:
 	sysfs_remove_group(&hdev->dev.kobj, &ps_attribute_group);
 	cancel_work_sync(&hidpp->work);
+	cancel_work_sync(&hidpp->reset_hi_res_work);
 	mutex_destroy(&hidpp->send_mutex);
 	return ret;
 }
-- 
2.43.0