HID: wacom: fix crash in wacom_aes_battery_handler()

JIRA: https://issues.redhat.com/browse/RHEL-102058
Upstream Status: v6.16

commit f305415
Author: Thomas Zeitlhofer <thomas.zeitlhofer+lkml@ze-it.at>
Date:   Mon May 19 10:54:46 2025 +0200

    HID: wacom: fix crash in wacom_aes_battery_handler()

    Commit fd2a9b2 ("HID: wacom: Remove AES power_supply after extended
    inactivity") introduced wacom_aes_battery_handler() which is scheduled
    as a delayed work (aes_battery_work).

    In wacom_remove(), aes_battery_work is not canceled. Consequently, if
    the device is removed while aes_battery_work is still pending, then hard
    crashes or "Oops: general protection fault..." are experienced when
    wacom_aes_battery_handler() is finally called. E.g., this happens with
    built-in USB devices after resume from hibernate when aes_battery_work
    was still pending at the time of hibernation.

    So, take care to cancel aes_battery_work in wacom_remove().

    Fixes: fd2a9b2 ("HID: wacom: Remove AES power_supply after extended inactivity")
    Signed-off-by: Thomas Zeitlhofer <thomas.zeitlhofer+lkml@ze-it.at>
    Acked-by: Ping Cheng <ping.cheng@wacom.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.com>

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>

Author: bentiss

drivers/hid/wacom_sys.c

@@ -2903,6 +2903,7 @@ static void wacom_remove(struct hid_device *hdev)
 	hid_hw_stop(hdev);
 
 	cancel_delayed_work_sync(&wacom->init_work);
+	cancel_delayed_work_sync(&wacom->aes_battery_work);
 	cancel_work_sync(&wacom->wireless_work);
 	cancel_work_sync(&wacom->battery_work);
 	cancel_work_sync(&wacom->remote_work);