From: Hyunjung Ko ms_play_effect() schedules ms->ff_worker to send the force-feedback report. ms is devm-allocated, so it is freed only after ms_remove() returns. Commit 1cfc77a64b71 ("HID: microsoft: move FF initialization to .input_configured()") dropped the cancel_work_sync(&ms->ff_worker) call that the remove path previously had, so an ff_worker scheduled just before the device goes away can still run after ms (and ms->hdev, ms->output_report_dmabuf) has been freed -- a use-after-free. Cancel ff_worker before hid_hw_stop() in ms_remove(), restoring the teardown the driver had before the FF-init rework (and matching hid-bigbenff). cancel_work_sync() is safe even if ff_worker was never initialized: ms is zero-allocated, so the work reads as idle. Fixes: 1cfc77a64b71 ("HID: microsoft: move FF initialization to .input_configured()") Cc: stable@vger.kernel.org Signed-off-by: Hyunjung Ko --- drivers/hid/hid-microsoft.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/hid/hid-microsoft.c b/drivers/hid/hid-microsoft.c index a7d3493..462fdaf 100644 --- a/drivers/hid/hid-microsoft.c +++ b/drivers/hid/hid-microsoft.c @@ -384,6 +384,9 @@ static int ms_probe(struct hid_device *hdev, const struct hid_device_id *id) } static void ms_remove(struct hid_device *hdev) { + struct ms_data *ms = hid_get_drvdata(hdev); + + cancel_work_sync(&ms->ff_worker); hid_hw_stop(hdev); } -- 2.43.0