[PATCH 1/2] HID: nintendo-switch2-usb: Fix potential deadlock on teardown

[Vicki Pfau <vi@endrift.com>]

As reported by Sashiko, there is a narrow window in which cancel_work_sync
on the message in work can block due to the work waiting on the mutex that
the canceling thread holds. We work around this by replacing it with a
non-sync cancel and a sync cancel later on, to ensure it's actually exited.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/message/20261006063000.A0B821F000FF%40smtp.kernel.org
Fixes: 9417132df63e ("HID: nintendo: Add preliminary Switch 2 controller driver")
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
 drivers/hid/hid-nintendo-switch2-usb.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/hid-nintendo-switch2-usb.c b/drivers/hid/hid-nintendo-switch2-usb.c
index 8b3b6841035d..d747000336dc 100644
--- a/drivers/hid/hid-nintendo-switch2-usb.c
+++ b/drivers/hid/hid-nintendo-switch2-usb.c
@@ -217,7 +217,7 @@ static void switch2_usb_free_in_urbs(struct switch2_usb *ns2_usb)
 	ns2_usb->shutdown = true;
 	spin_unlock_irqrestore(&ns2_usb->bulk_in_lock, flags);
 
-	cancel_work_sync(&ns2_usb->message_in_work);
+	cancel_work(&ns2_usb->message_in_work);
 
 	usb_kill_anchored_urbs(&ns2_usb->bulk_in_anchor);
 	for (i = 0; i < NS2_IN_URBS; i++) {
@@ -276,7 +276,7 @@ static void switch2_usb_shutdown(struct switch2_cfg_intf *intf)
 	ns2_usb->shutdown = true;
 	spin_unlock_irqrestore(&ns2_usb->bulk_in_lock, flags);
 
-	cancel_work_sync(&ns2_usb->message_in_work);
+	cancel_work(&ns2_usb->message_in_work);
 
 	usb_kill_anchored_urbs(&ns2_usb->bulk_in_anchor);
 	spin_lock_irqsave(&ns2_usb->bulk_in_lock, flags);
@@ -447,6 +447,7 @@ static int switch2_usb_probe(struct usb_interface *intf, const struct usb_device
 	switch2_usb_free_out_urbs(ns2_usb);
 err_free_in:
 	switch2_usb_free_in_urbs(ns2_usb);
+	cancel_work_sync(&ns2_usb->message_in_work);
 	devm_kfree(&intf->dev, ns2_usb);
 
 	return ret;
@@ -466,6 +467,8 @@ static void switch2_usb_disconnect(struct usb_interface *intf)
 		switch2_controller_detach_cfg(ns2_usb->cfg.parent);
 
 	switch2_usb_free_out_urbs(ns2_usb);
+
+	cancel_work_sync(&ns2_usb->message_in_work);
 }
 
 #define SWITCH2_CONTROLLER(vend, prod) \
-- 
2.54.0