Re: [PATCH] HID: hid-oxp: use cancel_delayed_work_sync() in remove

["Derek J. Clark" <derekjohn.clark@gmail.com>]

On September 4, 2026 3:58:00 AM PDT, Tristan Madani <tristmd@gmail.com> wrote:
>From: Tristan Madani <tristan@talencesecurity.com>
>
>oxp_hid_remove() uses cancel_delayed_work() for all three delayed work
>items.  cancel_delayed_work() only dequeues a pending work item without
>waiting for a currently executing callback to finish.  If any of the
>work callbacks (oxp_rgb_queue_fn, oxp_btn_queue_fn, oxp_mcu_init_fn) is
>running at the time of removal, the callback continues executing
>concurrently with hid_hw_close() and hid_hw_stop(), accessing the HID
>device after it has been closed and stopped.
>
>Use cancel_delayed_work_sync() instead to ensure that any in-progress
>work callback completes before device teardown proceeds.
>
>Fixes: 84910c459d65 ("HID: hid-oxp: Add OneXPlayer configuration driver")
>Cc: stable@vger.kernel.org
>Signed-off-by: Tristan Madani <tristan@talencesecurity.com>


Hi Tristan,

LGTM, thanks.

Reviewed-by: Derek J. Clark <derekjohn.clark@gmail.com>
>---
> drivers/hid/hid-oxp.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
>diff --git a/drivers/hid/hid-oxp.c b/drivers/hid/hid-oxp.c
>index d2ded6b08ce9e..1e691ebc1199e 100644
>--- a/drivers/hid/hid-oxp.c
>+++ b/drivers/hid/hid-oxp.c
>@@ -1552,9 +1552,9 @@ static int oxp_hid_probe(struct hid_device *hdev,
> 
> static void oxp_hid_remove(struct hid_device *hdev)
> {
>-	cancel_delayed_work(&drvdata.oxp_rgb_queue);
>-	cancel_delayed_work(&drvdata.oxp_btn_queue);
>-	cancel_delayed_work(&drvdata.oxp_mcu_init);
>+	cancel_delayed_work_sync(&drvdata.oxp_rgb_queue);
>+	cancel_delayed_work_sync(&drvdata.oxp_btn_queue);
>+	cancel_delayed_work_sync(&drvdata.oxp_mcu_init);
> 	hid_hw_close(hdev);
> 	hid_hw_stop(hdev);
> }