[PATCH 00/18] HID: logitech-hidpp: G920 force-feedback fixes, rework, and cleanups

[Dmitry Torokhov]

This series starts from Gideon Heinz's report of Logitech G920
force-feedback initialization timing out in v7.3 and addresses several
additional pre-existing bugs, lifetime races, and cleanup opportunities
found while auditing hid-logitech-hidpp.

The first seven patches carry Fixes and stable tags. They fix the v7.3
G920 force-feedback initialization timeout by temporarily enabling
device I/O around g920_get_config() in hidpp_input_configured(), switch
hidpp_ff_queue_work() to GFP_ATOMIC since playback, gain, and autocenter
callbacks run under the input event spinlock, drain the G920 FF
workqueue before closing the HID transport on input close so queued
commands still receive their USB interrupt IN replies, synchronously
disable driver work items before stopping the transport on removal and
probe failure, avoid storing an ERR_PTR in battery->ps on registration
failure, avoid NULL pointer subtraction in the HID++ 1.0 consumer keys
report fixup, and fix an off-by-one in G920 slot tracking that made the
63rd user effect in hardware slot 64 unusable and leaked it across
reopen.

The remaining patches rework G920 force-feedback initialization for next
and clean up surrounding driver state management. G920 capability
discovery moves back into hidpp_probe() while device I/O is already
active (keeping force feedback optional on failure and excluding generic
USB PID force feedback), device-level wheel settings are separated from
the input FF queue lifetime, the G920 range sysfs attribute moves to
driver dev_groups, and FF workqueue teardown moves into ff->stop so open
evdev handles across USB disconnect or driver unbind no longer cause
use-after-free. Follow-up cleanups switch multi-byte handling to
unaligned accessors, store device serials as byte arrays, and adopt
guard(mutex), __free(kfree), alloc_ordered_workqueue(),
devm_mutex_init(), and devm_device_add_group().

Please note that not everything in the driver is fixed by this series,
especially around stalls on close and teardown. Draining the FF
workqueue before hid_hw_close() keeps the USB interrupt IN endpoint
alive during a normal last-user close, but close still blocks flushing
asynchronous FF commands, and paths where device or transport I/O is
already stopped (such as driver unbind or module unload while effects
are loaded, inhibited input devices, or writing the sysfs range
attribute while the input device is closed) can still stall for 3 x 5
seconds per command because hidpp_send_message_sync() retries non-busy
timeouts and transport errors as if the device reported busy. Fixing the
synchronous send retry logic, converting sleepable FF operations
(upload, erase, and range) to synchronous execution with proper
transport lifetime handling, and fixing a few remaining battery
reporting bugs will come in a follow-up series.

Gideon, could you please give this full series a spin on your G920
(checking initialization, force feedback in fftest including exiting
back to the shell, range sysfs access, and general wheel/pedal input)
and, if anything breaks, ideally bisect within the series to pinpoint
the offending patch?

Thanks.

Dmitry Torokhov (18):
  HID: logitech-hidpp: fix G920 force-feedback initialization timeout
  HID: logitech-hidpp: use GFP_ATOMIC in hidpp_ff_queue_work()
  HID: logitech-hidpp: drain G920 FF workqueue before closing transport
  HID: logitech-hidpp: disable works before stopping transport
  HID: logitech-hidpp: do not store ERR_PTR in battery->ps
  HID: logitech-hidpp: avoid NULL subtraction in consumer key report
    fixup
  HID: logitech-hidpp: fix off-by-one in G920 force-feedback slot
    tracking
  HID: logitech-hidpp: rework G920 force-feedback initialization
  HID: logitech-hidpp: use sysfs_emit() in hidpp_ff_range_show()
  HID: logitech-hidpp: manage G920 range sysfs attribute via dev_groups
  HID: logitech-hidpp: shut down G920 force feedback on input unregister
  HID: logitech-hidpp: use unaligned accessors for multi-byte values
  HID: logitech-hidpp: store device serial as a byte array
  HID: logitech-hidpp: use guard() for send_mutex
  HID: logitech-hidpp: use __free(kfree) for temporary allocations
  HID: logitech-hidpp: use alloc_ordered_workqueue() for FF queue
  HID: logitech-hidpp: manage send_mutex with devm_mutex_init()
  HID: logitech-hidpp: manage ps_attribute_group with
    devm_device_add_group()

 drivers/hid/hid-logitech-hidpp.c | 509 ++++++++++++++++---------------
 1 file changed, 264 insertions(+), 245 deletions(-)

-- 
2.56.0.506.g506a7eabc5-goog