HID: Input: Add battery list cleanup with devm action

The batteries list (hdev->batteries) is not cleaned up during
hidinput_disconnect(), but struct hid_battery entries are allocated
with devm_kzalloc.
When a driver is unbound (e.g. during devicereprobe), devm frees those
entries while their list_head nodesremain dangling in hdev->batteries,
which persists across rebinds.

Link: https://lore.kernel.org/all/20260602011949.2825852-1-rafael@rcpassos.me/
Fixes: 4a58ae85c3f9 ("HID: input: Add support for multiple batteries per device")
Signed-off-by: Rafael Passos <rafael@rcpassos.me>
Acked-by: Lucas Zampieri <lcasmz54@gmail.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>

diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index d73cfa2e73d331a21abe770ec4241c4290ec1c5d..c7b8c4ff7a3385070b8d0b75e0df71705a4a5126 100644 (file)
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -519,6 +519,13 @@ static struct hid_battery *hidinput_find_battery(struct hid_device *dev,
        return NULL;
 }
 
+static void hidinput_cleanup_battery(void *res)
+{
+       struct hid_battery *bat = res;
+
+       list_del(&bat->list);
+}
+
 static int hidinput_setup_battery(struct hid_device *dev, unsigned report_type,
                                  struct hid_field *field, bool is_percentage)
 {
@@ -610,6 +617,12 @@ static int hidinput_setup_battery(struct hid_device *dev, unsigned report_type,
 
        power_supply_powers(bat->ps, &dev->dev);
        list_add_tail(&bat->list, &dev->batteries);
+
+       error = devm_add_action_or_reset(&dev->dev,
+                                        hidinput_cleanup_battery, bat);
+       if (error)
+               return error;
+
        return 0;
 
 err_free_name: