[PATCH v2 1/3] HID: nintendo-switch2-usb: Fix potential deadlock on teardown

[Vicki Pfau <vi@endrift.com>]

As reported by Sashiko, there is a narrow window in which cancel_work_sync
on the message in work can block due to the work waiting on the mutex that
the canceling thread holds. By moving the pointer clearing and unlocking
the mutex before calling cfg->shutdown we can avoid this deadlock.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20261006061619.2005967-1-vi%40endrift.com?part=1
Fixes: 9417132df63e ("HID: nintendo: Add preliminary Switch 2 controller driver")
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
 drivers/hid/hid-nintendo.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/hid/hid-nintendo.c b/drivers/hid/hid-nintendo.c
index 4d40f67f3e64..d235de6868a2 100644
--- a/drivers/hid/hid-nintendo.c
+++ b/drivers/hid/hid-nintendo.c
@@ -4292,6 +4292,7 @@ int switch2_controller_attach_cfg(const char *phys, struct switch2_cfg_intf *cfg
 	mutex_lock(&ns2->lock);
 	if (ns2->cfg) {
 		ret = -EBUSY;
+		mutex_unlock(&ns2->lock);
 		goto out;
 	}
 	cfg->parent = ns2;
@@ -4301,15 +4302,16 @@ int switch2_controller_attach_cfg(const char *phys, struct switch2_cfg_intf *cfg
 		ret = switch2_init_controller(ns2);
 
 	if (ret < 0) {
+		ns2->cfg = NULL;
+		mutex_unlock(&ns2->lock);
 		if (cfg->shutdown)
 			cfg->shutdown(cfg);
 		cfg->parent = NULL;
-		ns2->cfg = NULL;
+	} else {
+		mutex_unlock(&ns2->lock);
 	}
 
 out:
-	mutex_unlock(&ns2->lock);
-
 	if (ret < 0)
 		kref_put(&ns2->refcount, switch2_kref_put);
 	return ret;
-- 
2.54.0