Merge tag 'input-for-v7.2-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

Pull input updates from Dmitry Torokhov:

 - A new driver for Wacom W9000-series penabled touchscreens

 - Updates to STM FTS driver adding support for reset line and preparing
   the driver for STMFTS5 support

 - Updates to RMI4 and IMS PCU drivers hardening the code

 - Support for half-duplex mode restored in ADS7846 driver

 - Updates to driver's device_id tables to use named initializers

 - Removal of no longer used PCAP keys and touchscreen drivers (support
   for the ezx series of phones was removed in 2022)

 - Removal of xilinx_ps2 driver which is no longer used either

 - Updates to userio to allow setting up additional serio port
   characteristics (such as id, extra and proto)

 - Assorted hardening and cleanup fixes for other drivers

* tag 'input-for-v7.2-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (72 commits)
  Input: mms114 - fix touch indexing for MMS134S and MMS136
  Input: elan_i2c - prevent division by zero and arithmetic underflow
  Input: stop force-feedback timer when unregistering input devices
  Input: iforce - bound the device-reported force-feedback effect index
  Input: goodix - clamp the device-reported contact count
  Input: mms114 - reject an oversized device packet size
  Input: touchwin - reset the packet index on every complete packet
  Input: rmi4 - update formatting in F12
  Input: rmi4 - propagate proper error code in F12 sensor tuning
  Input: rmi4 - simplify size calculations in F12
  Input: rmi4 - use sizeof(*ptr) and idiomatic checks in f12 allocators
  Input: rmi4 - use devm_kmalloc for F12 data packet buffer
  Input: rmi4 - use flexible array member for IRQ masks in F12
  Input: rmi4 - use unaligned access helpers in F12
  Input: rmi4 - change reg_size type to u32
  Input: rmi4 - refactor F12 probe function
  Input: rmi4 - use kzalloc_flex() for struct rmi_function
  Input: rmi4 - refactor function allocation and registration
  Input: rmi4 - use local presence map in rmi_read_register_desc()
  Input: rmi4 - fix limit in rmi_register_desc_has_subpacket()
  ...

1 files changed, 21 insertions, 6 deletions

diff --git a/drivers/input/ff-memless.c b/drivers/input/ff-memless.c
index 937370d04928..d1fefd1dfc0d 100644
--- a/drivers/input/ff-memless.c
+++ b/drivers/input/ff-memless.c
@@ -484,17 +484,31 @@ static void ml_ff_destroy(struct ff_device *ff)
 	struct ml_device *ml = ff->private;
 
 	/*
-	 * Even though we stop all playing effects when tearing down
-	 * an input device (via input_device_flush() that calls into
-	 * input_ff_flush() that stops and erases all effects), we
-	 * do not actually stop the timer, and therefore we should
-	 * do it here.
+	 * The timer is normally shut down in ml_ff_stop() when the device
+	 * is unregistered. However, we still shut it down here as a safety
+	 * net and for cases where the device was never registered (e.g.
+	 * error paths during probe).
 	 */
-	timer_delete_sync(&ml->timer);
+	timer_shutdown_sync(&ml->timer);
 
 	kfree(ml->private);
 }
 
+static void ml_ff_stop(struct ff_device *ff)
+{
+	struct ml_device *ml = ff->private;
+
+	/*
+	 * Even though we stop all playing effects when tearing down an
+	 * input device (by the way of evdev calling input_flush_device()
+	 * that calls into input_ff_flush() that stops and erases all
+	 * effects), we do not actually shutdown the timer, and therefore
+	 * we should do it here to prevent it firing after the input
+	 * device is unregistered and its associated resources are freed.
+	 */
+	timer_shutdown_sync(&ml->timer);
+}
+
 /**
  * input_ff_create_memless() - create memoryless force-feedback device
  * @dev: input device supporting force-feedback
@@ -529,6 +543,7 @@ int input_ff_create_memless(struct input_dev *dev, void *data,
 	ff->playback = ml_ff_playback;
 	ff->set_gain = ml_ff_set_gain;
 	ff->destroy = ml_ff_destroy;
+	ff->stop = ml_ff_stop;
 
 	/* we can emulate periodic effects with RUMBLE */
 	if (test_bit(FF_RUMBLE, ff->ffbit)) {