Re: [PATCH] HID: logitech-hidpp: cancel reset_hi_res_work on probe failure

[Jiri Kosina]

On Sun, 13 Sep 2026, Guangshuo Li wrote:

> hidpp_probe() initializes reset_hi_res_work before starting the device.
> Once device I/O is started, incoming HID++ events may schedule this work.
> 
> If a later probe step fails, the error path stops the hardware and
> cancels hidpp->work, but leaves reset_hi_res_work pending. Since hidpp
> is devm allocated, it may be freed after probe returns while the work
> is still queued, potentially resulting in a use-after-free when the
> work handler runs.
> 
> Cancel reset_hi_res_work in the probe error path, matching the cleanup
> performed by hidpp_remove().
> 
> This issue was found by manual code inspection.
> 
> Fixes: ed80cc4667ac ("HID: logitech-hidpp: Add HIDPP_QUIRK_RESET_HI_RES_SCROLL")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
> ---
>  drivers/hid/hid-logitech-hidpp.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
> index 1504de32b1c8..6a21b281a1df 100644
> --- a/drivers/hid/hid-logitech-hidpp.c
> +++ b/drivers/hid/hid-logitech-hidpp.c
> @@ -4834,6 +4834,7 @@ static int hidpp_probe(struct hid_device *hdev, const struct hid_device_id *id)
>  hid_hw_start_fail:
>  	sysfs_remove_group(&hdev->dev.kobj, &ps_attribute_group);
>  	cancel_work_sync(&hidpp->work);
> +	cancel_work_sync(&hidpp->reset_hi_res_work);
>  	mutex_destroy(&hidpp->send_mutex);
>  	return ret;

Already fixed via 0be03caba6c002 in hid.git, thanks.

-- 
Jiri Kosina
SUSE Labs