Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= <jose.exposito89@gmail.com>
To:     jikos@kernel.org
Cc:     benjamin.tissoires@redhat.com, linux-input@vger.kernel.org,
        linux-kernel@vger.kernel.org,
        =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= <jose.exposito89@gmail.com>
Subject: [PATCH] HID: magicmouse: fix crash when disconnecting Magic Trackpad 2
Date:   Sun,  9 May 2021 17:51:38 +0200
Message-Id: <20210509155138.39601-1-jose.exposito89@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Precedence: bulk

When the Apple Magic Trackpad 2 is connected over USB it registers four
hid_device interfaces, however, the driver only handles the one with
type HID_TYPE_USBMOUSE and ignores the other three, thus, no driver
data is attached to them.

When the device is disconnected, the remove method is called for the
four hid_device interfaces, crashing when the driver data is NULL.

Check that the driver data is not NULL before using it on the remove
callback.

Signed-off-by: José Expósito <jose.exposito89@gmail.com>
---
 linux/drivers/hid/hid-magicmouse.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/linux/drivers/hid/hid-magicmouse.c b/linux/drivers/hid/hid-magicmouse.c
index 2bb473d..097870e 100644
--- a/linux/drivers/hid/hid-magicmouse.c
+++ b/linux/drivers/hid/hid-magicmouse.c
@@ -779,7 +779,10 @@ err_stop_hw:
 static void magicmouse_remove(struct hid_device *hdev)
 {
 	struct magicmouse_sc *msc = hid_get_drvdata(hdev);
-	cancel_delayed_work_sync(&msc->work);
+
+	if (msc)
+		cancel_delayed_work_sync(&msc->work);
+
 	hid_hw_stop(hdev);
 }
 
-- 
2.25.1