[PATCH 1/2] HID: lenovo: stop the hardware before the per-model teardown

[Oleg Keri]

lenovo_remove() runs the per-model teardown first and calls hid_hw_stop()
last.  For the ThinkPad 10 Ultrabook Keyboard and the X1/X12/X13 Tablet
keyboards that teardown ends in cancel_work_sync(&data->fn_lock_sync_work),
but the hardware is still delivering events at that point, and
lenovo_event_tp10ubkbd() re-queues that work on every Fn-Esc press.  A
press landing after the cancel leaves the work pending when remove()
returns; devres then frees the drvdata and the work runs on freed memory.

Stop the hardware first so no event can arrive once the teardown starts.
The LED-off writes issued by led_classdev_unregister() after the stop are
harmless: usbhid sets HID_DISCONNECTED in usbhid_stop() and
__usbhid_submit_report() drops the request on it, and the raw_request path
used by the tablet keyboards is a plain synchronous control transfer.

Fixes: bc04b37ea0ec ("HID: lenovo: Add ThinkPad 10 Ultrabook Keyboard support")
Link: https://lore.kernel.org/all/20260910064345.9BF1E1F000FF@xxxxxxxxxxxxxxx/
Signed-off-by: Oleg Keri <okerixx@xxxxxxxxx>
---
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c
index 617bba6..ff7c5ef 100644
--- a/drivers/hid/hid-lenovo.c
+++ b/drivers/hid/hid-lenovo.c
@@ -1498,6 +1498,8 @@ static void lenovo_remove_tp10ubkbd(struct hid_device *hdev)
 
 static void lenovo_remove(struct hid_device *hdev)
 {
+	hid_hw_stop(hdev);
+
 	switch (hdev->product) {
 	case USB_DEVICE_ID_LENOVO_TPKBD:
 		lenovo_remove_tpkbd(hdev);
@@ -1518,8 +1520,6 @@ static void lenovo_remove(struct hid_device *hdev)
 		lenovo_remove_tp10ubkbd(hdev);
 		break;
 	}
-
-	hid_hw_stop(hdev);
 }
 
 static int lenovo_input_configured(struct hid_device *hdev,
-- 
2.55.0