OSDN Git Service

HID: nintendo: fix rumble worker null pointer deref
authorDaniel J. Ogorchock <djogorchock@gmail.com>
Wed, 13 Jul 2022 20:20:59 +0000 (16:20 -0400)
committerJiri Kosina <jkosina@suse.cz>
Thu, 25 Aug 2022 13:15:17 +0000 (15:15 +0200)
commit1ff89e06c2e5fab30274e4b02360d4241d6e605e
treedc7971c0d8c3df00467774ef0448d4fd3e2f368c
parent467249a7dff68451868ca79696aef69764193a8a
HID: nintendo: fix rumble worker null pointer deref

We can dereference a null pointer trying to queue work to a destroyed
workqueue.

If the device is disconnected, nintendo_hid_remove is called, in which
the rumble_queue is destroyed. Avoid using that queue to defer rumble
work once the controller state is set to JOYCON_CTLR_STATE_REMOVED.

This eliminates the null pointer dereference.

Signed-off-by: Daniel J. Ogorchock <djogorchock@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
drivers/hid/hid-nintendo.c