HID: corsair-void: Add missing delayed work cancel for headset status

stuarthayhurst · Jiri Kosina · commit 48e487b00289 · 2025-02-03T10:51:24.000+01:00
The cancel_delayed_work_sync() call was missed, causing a use-after-free in corsair_void_remove(). Reported-by: yan kang <kangyan91@outlook.com> Reported-by: yue sun <samsun1006219@gmail.com> Closes: https://lore.kernel.org/all/SY8P300MB042106286A2536707D2FB736A1E42@SY8P300MB0421.AUSP300.PROD.OUTLOOK.COM/ Closes: https://lore.kernel.org/all/SY8P300MB0421872E0AE934C9616FA61EA1E42@SY8P300MB0421.AUSP300.PROD.OUTLOOK.COM/ Fixes: 6ea2a6f ("HID: corsair-void: Add Corsair Void headset family driver") Cc: stable@vger.kernel.org Signed-off-by: Stuart Hayhurst <stuart.a.hayhurst@gmail.com> Signed-off-by: Jiri Kosina <jkosina@suse.com>
diff --git a/drivers/hid/hid-corsair-void.c b/drivers/hid/hid-corsair-void.c
@@ -726,6 +726,7 @@ static void corsair_void_remove(struct hid_device *hid_dev)
 	if (drvdata->battery)
 		power_supply_unregister(drvdata->battery);
 
+	cancel_delayed_work_sync(&drvdata->delayed_status_work);
 	cancel_delayed_work_sync(&drvdata->delayed_firmware_work);
 	sysfs_remove_group(&hid_dev->dev.kobj, &corsair_void_attr_group);
 }

Original file line number	Diff line number	Diff line change
`@@ -726,6 +726,7 @@ static void corsair_void_remove(struct hid_device *hid_dev)`
`726`	`726`	`if (drvdata->battery)`
`727`	`727`	`power_supply_unregister(drvdata->battery);`
`728`	`728`
	`729`	`+ cancel_delayed_work_sync(&drvdata->delayed_status_work);`
`729`	`730`	`cancel_delayed_work_sync(&drvdata->delayed_firmware_work);`
`730`	`731`	`sysfs_remove_group(&hid_dev->dev.kobj, &corsair_void_attr_group);`
`731`	`732`	`}`