Catcrafts/milos-linux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

HID: Input: Add battery list cleanup with devm action

Browse source 
commit 426e5846eba75feaf1c9c6c119cb153610192da1 upstream.

The batteries list (hdev->batteries) is not cleaned up during
hidinput_disconnect(), but struct hid_battery entries are allocated
with devm_kzalloc.
When a driver is unbound (e.g. during devicereprobe), devm frees those
entries while their list_head nodesremain dangling in hdev->batteries,
which persists across rebinds.

Link: https://lore.kernel.org/all/20260602011949.2825852-1-rafael@rcpassos.me/
Fixes: 4a58ae85c3 ("HID: input: Add support for multiple batteries per device")
Signed-off-by: Rafael Passos <rafael@rcpassos.me>
Acked-by: Lucas Zampieri <lcasmz54@gmail.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Rafael Passos 2026-06-02 00:05:19 -03:00 • committed by Greg Kroah-Hartman
commit b15b03d691
1 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
drivers/hid/hid-input.c
View file

@ -519,6 +519,13 @@ static struct hid_battery *hidinput_find_battery(struct hid_device *dev,
return NULL; return NULL;
} }
static void hidinput_cleanup_battery(void *res)
{
struct hid_battery *bat = res;
list_del(&bat->list);
}
static int hidinput_setup_battery(struct hid_device *dev, unsigned report_type, static int hidinput_setup_battery(struct hid_device *dev, unsigned report_type,
struct hid_field *field, bool is_percentage) struct hid_field *field, bool is_percentage)
{ {
@ -610,6 +617,12 @@ static int hidinput_setup_battery(struct hid_device *dev, unsigned report_type,
power_supply_powers(bat->ps, &dev->dev); power_supply_powers(bat->ps, &dev->dev);
list_add_tail(&bat->list, &dev->batteries); list_add_tail(&bat->list, &dev->batteries);
error = devm_add_action_or_reset(&dev->dev,
hidinput_cleanup_battery, bat);
if (error)
return error;
return 0; return 0;
err_free_name: err_free_name: