From: "David Rheinsberg" <david@readahead.eu>
To: "Rafael Passos" <rafael@rcpassos.me>,
"Jiri Kosina" <jikos@kernel.org>,
"Benjamin Tissoires" <bentiss@kernel.org>
Cc: "Shuah Khan" <skhan@linuxfoundation.org>,
"Brigham Campbell" <me@brighamcampbell.com>,
"Jori Koolstra" <jkoolstra@xs4all.nl>,
linux-input@vger.kernel.org
Subject: Re: [PATCH v3 3/4] HID: wiimote: use scoped cleanup in wiimote and led probes
Date: Fri, 31 Jul 2026 13:18:57 +0200 [thread overview]
Message-ID: <42b2b3bf-a165-4caf-a746-0c37bfa925a2@app.fastmail.com> (raw)
In-Reply-To: <20260729164928.1138468-4-rafael@rcpassos.me>
Hi
On Wed, Jul 29, 2026, at 6:49 PM, Rafael Passos wrote:
> Cleanup code in wiimote/led probe function, using the scoped cleanup.
> This prevents mistakes in future changes to this function.
>
> In wiimote_probe_clenaup, a few functions are safe to call without
> checking. For the hid_hw calls, a new bit mask was introduced to track
> probing state.
Is this patch worth it? the led-probe looks ok, but the wiimote_probe() change looks convoluted. If you really want to go that route I would prefer if you reuse wiimote_destroy() and ensure it checks for the right conditions, rather than adding __wiimote_probe_cleanup().
Thanks
David
> Signed-off-by: Rafael Passos <rafael@rcpassos.me>
> ---
> drivers/hid/hid-wiimote-core.c | 68 ++++++++++++++++++-------------
> drivers/hid/hid-wiimote-modules.c | 17 ++++----
> drivers/hid/hid-wiimote.h | 1 +
> 3 files changed, 48 insertions(+), 38 deletions(-)
>
> diff --git a/drivers/hid/hid-wiimote-core.c b/drivers/hid/hid-wiimote-core.c
> index 762b3c383194e..31ee86affc553 100644
> --- a/drivers/hid/hid-wiimote-core.c
> +++ b/drivers/hid/hid-wiimote-core.c
> @@ -1772,16 +1772,40 @@ static void wiimote_destroy(struct wiimote_data *wdata)
> /* Global id allocator for wii remotes */
> static DEFINE_IDA(wiimote_ida);
>
> +#define WIIMOTE_PROBE_HW_STARTED BIT(0) // hid_hw_start succeeded
> +#define WIIMOTE_PROBE_HW_OPENED BIT(1) // hid_hw_open succeeded
> +
> +static void __wiimote_probe_cleanup(struct wiimote_data *wdata)
> +{
> + if (!wdata)
> + return;
> +
> + if (wdata->player_id)
> + ida_free(&wiimote_ida, wdata->player_id);
> +
> + // safe, debugfs checks IS_ERR_OR_NULL
> + wiidebug_deinit(wdata);
> + // safe, checks dev for NULL
> + device_remove_file(&wdata->hdev->dev, &dev_attr_devtype);
> + device_remove_file(&wdata->hdev->dev, &dev_attr_extension);
> + if (wdata->probe_state & WIIMOTE_PROBE_HW_OPENED)
> + hid_hw_close(wdata->hdev);
> + if (wdata->probe_state & WIIMOTE_PROBE_HW_STARTED)
> + hid_hw_stop(wdata->hdev);
> + kfree(wdata);
> +}
> +
> +DEFINE_FREE(wiimote_probe_cleanup, struct wiimote_data *,
> + __wiimote_probe_cleanup(_T))
> +
> static int wiimote_hid_probe(struct hid_device *hdev,
> const struct hid_device_id *id)
> {
> - struct wiimote_data *wdata;
> int ret;
> - int player_id;
>
> hdev->quirks |= HID_QUIRK_NO_INIT_REPORTS;
>
> - wdata = wiimote_create(hdev);
> + struct wiimote_data *wdata __free(wiimote_probe_cleanup) =
> wiimote_create(hdev);
> if (!wdata) {
> hid_err(hdev, "Can't alloc device\n");
> return -ENOMEM;
> @@ -1790,68 +1814,54 @@ static int wiimote_hid_probe(struct hid_device
> *hdev,
> ret = hid_parse(hdev);
> if (ret) {
> hid_err(hdev, "HID parse failed\n");
> - goto err;
> + return ret;
> }
>
> ret = hid_hw_start(hdev, HID_CONNECT_HIDRAW);
> if (ret) {
> hid_err(hdev, "HW start failed\n");
> - goto err;
> + return ret;
> }
> + wdata->probe_state |= WIIMOTE_PROBE_HW_STARTED;
>
> ret = hid_hw_open(hdev);
> if (ret) {
> hid_err(hdev, "cannot start hardware I/O\n");
> - goto err_stop;
> + return ret;
> }
> + wdata->probe_state |= WIIMOTE_PROBE_HW_OPENED;
>
> ret = device_create_file(&hdev->dev, &dev_attr_extension);
> if (ret) {
> hid_err(hdev, "cannot create sysfs attribute\n");
> - goto err_close;
> + return ret;
> }
>
> ret = device_create_file(&hdev->dev, &dev_attr_devtype);
> if (ret) {
> hid_err(hdev, "cannot create sysfs attribute\n");
> - goto err_ext;
> + return ret;
> }
>
> ret = wiidebug_init(wdata);
> if (ret)
> - goto err_free;
> + return ret;
>
> - player_id = ida_alloc_min(&wiimote_ida, 1, GFP_KERNEL);
> + int player_id = ida_alloc_min(&wiimote_ida, 1, GFP_KERNEL);
> if (player_id < 1) {
> hid_err(hdev, "cannot allocate controller id\n");
> ret = player_id;
> - goto err_free;
> + return ret;
> }
> -
> wdata->player_id = player_id;
>
> +
> hid_info(hdev, "New device registered (Wiimote %d)\n", player_id);
>
> /* schedule device detection */
> wiimote_schedule(wdata);
> -
> + retain_and_null_ptr(wdata);
> return 0;
> -
> -err_free:
> - wiimote_destroy(wdata);
> - return ret;
> -
> -err_ext:
> - device_remove_file(&wdata->hdev->dev, &dev_attr_extension);
> -err_close:
> - hid_hw_close(hdev);
> -err_stop:
> - hid_hw_stop(hdev);
> -err:
> - input_free_device(wdata->ir);
> - input_free_device(wdata->accel);
> - kfree(wdata);
> - return ret;
> }
>
> static void wiimote_hid_remove(struct hid_device *hdev)
> diff --git a/drivers/hid/hid-wiimote-modules.c
> b/drivers/hid/hid-wiimote-modules.c
> index 3cd6144667404..47fa6a8ecdaef 100644
> --- a/drivers/hid/hid-wiimote-modules.c
> +++ b/drivers/hid/hid-wiimote-modules.c
> @@ -341,11 +341,11 @@ static int wiimod_led_probe(const struct
> wiimod_ops *ops,
> {
> struct device *dev = &wdata->hdev->dev;
> size_t namesz = strlen(dev_name(dev)) + 9;
> - struct led_classdev *led;
> char *name;
> int ret;
>
> - led = kzalloc(sizeof(struct led_classdev) + namesz, GFP_KERNEL);
> + struct led_classdev *led __free(kfree) =
> + kzalloc(sizeof(struct led_classdev) + namesz, GFP_KERNEL);
> if (!led)
> return -ENOMEM;
>
> @@ -359,8 +359,12 @@ static int wiimod_led_probe(const struct wiimod_ops *ops,
>
> wdata->leds[ops->arg] = led;
> ret = led_classdev_register(dev, led);
> - if (ret)
> - goto err_free;
> + if (ret) {
> + wdata->leds[ops->arg] = NULL;
> + return ret;
> + }
> +
> + retain_and_null_ptr(led);
>
> /* enable LED1 to stop initial LED-blinking */
> if (ops->arg == 0) {
> @@ -369,11 +373,6 @@ static int wiimod_led_probe(const struct wiimod_ops *ops,
> }
>
> return 0;
> -
> -err_free:
> - wdata->leds[ops->arg] = NULL;
> - kfree(led);
> - return ret;
> }
>
> static void wiimod_led_remove(const struct wiimod_ops *ops,
> diff --git a/drivers/hid/hid-wiimote.h b/drivers/hid/hid-wiimote.h
> index a53f72d5077ef..6812efa589c93 100644
> --- a/drivers/hid/hid-wiimote.h
> +++ b/drivers/hid/hid-wiimote.h
> @@ -154,6 +154,7 @@ struct wiimote_data {
> struct timer_list timer;
> struct wiimote_debug *debug;
> __u8 player_id;
> + __u8 probe_state;
>
> union {
> struct input_dev *input;
> --
> 2.53.0
next prev parent reply other threads:[~2026-07-31 11:19 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-29 16:49 [PATCH v3 0/4] HID: wiimote: new LED behavior on connect, scoped guards, uaf Rafael Passos
2026-07-29 16:49 ` [PATCH v3 1/4] HID: wiimote: turn on the LEDs indicating the controller id Rafael Passos
2026-07-29 17:07 ` sashiko-bot
2026-07-31 9:02 ` David Rheinsberg
2026-07-29 16:49 ` [PATCH v3 2/4] HID: wiimote: replace spinlock pairs with scoped_guard Rafael Passos
2026-07-29 17:07 ` sashiko-bot
2026-07-31 9:08 ` David Rheinsberg
2026-07-29 16:49 ` [PATCH v3 3/4] HID: wiimote: use scoped cleanup in wiimote and led probes Rafael Passos
2026-07-29 17:14 ` sashiko-bot
2026-07-31 11:18 ` David Rheinsberg [this message]
2026-07-29 16:49 ` [PATCH v3 4/4] HID: wiimote: fix uaf when hid events are handled during destroy Rafael Passos
2026-07-29 17:14 ` sashiko-bot
2026-07-31 11:17 ` David Rheinsberg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=42b2b3bf-a165-4caf-a746-0c37bfa925a2@app.fastmail.com \
--to=david@readahead.eu \
--cc=bentiss@kernel.org \
--cc=jikos@kernel.org \
--cc=jkoolstra@xs4all.nl \
--cc=linux-input@vger.kernel.org \
--cc=me@brighamcampbell.com \
--cc=rafael@rcpassos.me \
--cc=skhan@linuxfoundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox